Edit

First-run experience with Autopilot and the Enrollment Status Page

  • Article

Microsoft Managed Desktop uses both Windows Autopilot and Microsoft Intune's Enrollment Status Page (ESP) to provide the best possible first-run experience to your users.

Initial deployment

To provide the ESP experience, you must register devices in the Microsoft Managed Desktop service. For more about registration, see Manual registration or Partner registration. Enrollment Status Page and Autopilot for pre-provisioned deployment are enabled by default in Microsoft Managed Desktop.

Autopilot profile settings

Microsoft Managed Desktop uses these settings in the Autopilot profile used for your users' devices:

MMD-%RAND:11% Autopilot settings

Setting Value
Deployment mode User Driven
Join to Microsoft Entra ID as Microsoft Entra joined
Language (Region) User Select
Automatically configure keyboard No
Microsoft Software License Terms Hide
Privacy settings Hide
Hide change account options Show
User account type Standard
Allow White Glove Out of Box Experience (OOBE) Yes
Apply device name template Yes
Enter a name MMD-%RAND:11%

Kiosk-%RAND:9% Autopilot settings

These settings apply to devices with the Kiosk device profile assigned.

Setting Value
Deployment mode Self-Deploying
Join to Microsoft Entra ID as Microsoft Entra joined
Language (Region) Operating system default
Automatically configure keyboard No
Microsoft Software License Terms Hide
Privacy settings Hide
Hide change account options Hide
User account type Standard
Allow White Glove Out of Box Experience (OOBE) Yes
Apply device name template Yes
Enter a name Kiosk-%RAND:9%

Enrollment Status Page settings

Microsoft Managed Desktop uses these settings for the Enrollment Status Page experience:

MMD-%RAND:11% Enrollment Status Page settings

Setting Value
Show app and profile configuration progress Yes
Show an error when installation takes longer than specified number of minutes 60
Show custom message when time limit error occurs No
Turn on log collection and diagnostics page for end users Yes
Only show page to devices provisioned by out-of-box experience (OOBE) Yes
Block device use until all apps and profiles are installed Yes
Allow users to reset device if installation error occurs Yes
Allow users to use device if installation error occurs Yes
Block device use until these required apps are installed if they're assigned to the user/device
  • Modern Workplace - Time Correction
  • Modern Workplace - Client Library
 Yes

Kiosk-%RAND:9% Enrollment Status Page settings

Setting Value
Show app and profile configuration progress Yes
Show an error when installation takes longer than specified number of minutes 60
Show custom message when time limit error occurs No
Turn on log collection and diagnostics page for end users Yes
Only show page to devices provisioned by out-of-box experience (OOBE) Yes
Block device use until all apps and profiles are installed Yes
Allow users to reset device if installation error occurs Yes
Allow users to use device if installation error occurs Yes
Block device use until these required apps are installed if they're assigned to the user/device
  • Modern Workplace - Time Correction
  • Modern Workplace - Client Library
 All

Enrollment Status Page experience

The Enrollment Status Page experience occurs in three phases. For more, see Enrollment Status Page tracking information.

The experience proceeds as follows:

  1. The Autopilot experience starts and the user enters their credentials.
  2. The device opens the Enrollment Status Page and proceeds through Device Preparation and Device Set up phases. The third step (Account Setup) is currently skipped in the Microsoft Managed Desktop configuration because the User ESP is disabled. The device restarts.
  3. After restarting, the device opens the Windows sign-in page with Other user.
  4. The users enter their credentials again and the desktop opens.

Note

Win32 apps are only deployed during ESP if the Windows 10 version is 1903 or later.

Start page of Autopilot setup showing "device preparation" and "device setup" phases.

Additional prerequisites for Autopilot for pre-provisioned deployment

  • Device must have a wired network connection.
  • If you have devices that were registered using the Microsoft Managed Desktop admin center before August 2020, de-register and re-register the devices.
  • Devices must have a factory image that includes the November 2020 cumulative update 19H1/19H2 2020.11C, or 20H1 2020.11C installed, or must be reimaged with the latest Microsoft Managed Desktop image.
  • Physical devices must support TPM 2.0 and device attestation. Virtual machines aren't supported. The pre-provisioning process uses Windows Autopilot self-deploying capabilities, so TPM 2.0 is required. The TPM attestation process also requires access to a set of HTTPS URLs that are unique for each TPM provider. For more information, see the entry for Autopilot self-deploying mode and Autopilot pre-provisioned deployment in Windows Autopilot networking requirements.

Sequence of events in Autopilot for pre-provisioned deployment

  1. IT Admin reimages or resets the device if needed.
  2. IT Admin boots the device, reaches the out-of-box-experience, and presses the Windows key five times.
  3. IT Admin selects Windows Autopilot Provisioning and then selects Continue. On the Windows Autopilot configuration screen, information will be displayed about the device.
  4. IT admin selects Provision to start the provisioning process.
  5. Device starts ESP and goes through device preparation and setup phases. During the device setup phase, you'll see App installation x of x displayed (depending on the exact configuration of the ESP profile).
  6. The account setup step is currently skipped in the Microsoft Managed Desktop configuration, since we disable User ESP.
  7. The device restarts.

After it restarts, the device will show the green status screen, with a Reseal button.

Important

Known issues:

  • ESP does not run again after the Autopilot for pre-provisioned deployment reseal function.
  • Device are not being renamed by Autopilot for pre-provisioned deployment. The device will only be renamed after going through the ESP user flow.

Change to Autopilot and Enrollment Status Page settings

If the setup used by Microsoft Managed Desktop doesn't exactly match your needs, you can file a support ticket through the Azure portal. Here are some examples of the types of configuration you might need:

Autopilot settings change

You might want to request a different device name template. You can't, however, change Deployment Mode, Join to Microsoft Entra ID As, Privacy Settings, or User Account Type.

Enrollment Status Page settings change

  • A longer number of minutes for the "Show an error when installation takes longer than specified number of minutes" setting.
  • The error message displayed.
  • Adding or removing applications in the "Block device use until these required apps are installed if they're assigned to the user/device" setting.

Required applications

  • You must target applications in the Modern Workplace device groups Test, First, Fast, and Broad. Applications must install in the "System" context. Make sure to complete testing with ESP in the Test group before you assign them to all groups.
  • No applications should require the device to restart. We recommend that applications be set to "Do nothing" when you build the application package if the device requires a restart.
  • Limit required applications to only the core applications that a user needs immediately when they sign in to the device.
  • Keep the total size of all applications collectively under 1 GB to avoid timeouts during the application installation phase.
  • Ideally, apps shouldn't have any dependencies. If you have apps that must have dependencies, be sure you configure, test, and validate them as part of your ESP evaluation.
  • Microsoft Teams can't be included in ESP.