Block access to a device until specific apps are installed

ESP-BlockApps-TweetThis week a short blog post about a recently introduced feature in the Enrollment Status Page (ESP). The ability block access to a device until specific apps are installed. I also tweeted about that feature recently and I thought it would be good to document the use case, the configurations and the end-user experience.


Let’s start with a short introduction. The ESP is strongly recommended with Windows Autopilot. The idea of the ESP, is to block the device until the device is ready for usage by the user. This new feature enables an administrator to only block the device until the most important apps are installed for the user. That enables the user to be earlier productive. The administrator simply chooses which apps are tracked on the ESP and until those apps are installed, the user can’t use the device.

With the recent updates to Microsoft Intune, the ESP can track the following apps:

  • Licensed Microsoft Store for Business apps;
  • Line-of-business apps (APPX, MSIX, single-file MSI)
  • Office 365 ProPlus apps

Note; Keep in mind that there are difference between the user context and the system context. For the exact up-to-date details see the links in section More information.


Now let’s continue by looking at the available configuration options. The following three steps walk through adjusting the default ESP. Those steps will show which configurations are required to get to the available configuration options for tracking specific apps. Similar steps are applicable when configuring custom ESPs.

1 Open the Azure portal and navigate to Microsoft Intune > Device enrollment > Windows enrollment > Enrollment Status Page (Preview) to open the Enrollment Status Page (Preview) blade;
2 On the Enrollment Status Page (Preview) blade, select Default > Settings to open the All users and all devices – Settings blade;
3a On the All users and all devices – Settings blade, select Yes with Show app and profile installation progress and Yes with Block device use until all apps and profiles are installed to enable the Block device use until these required apps are installed if they are assigned to the user/device setting (see step 3b);
3b When the Block device use until these required apps are installed if they are assigned to the user/device setting is enabled, select Select apps to open the Select apps blade. On the Select apps blade, select the required apps and click Select to return to the All users and all devices – Settings blade and click Save;

Note: Keep in mind that if the ESP is configured to track Office 365 ProPlus apps, other large apps, or just many apps, it might be required to also increase the timeout as documented in this Support Tip.

End-user experience

Now let’s end this post by looking at the end-user experience. The good thing is that the user will not notice any big differences. The user will still get the same screens and the same experiences. Only users that pay attention to details will notice the small differences. As shown below, the user will see a list of apps that is equal to the number of configured apps by the administrator. That list is most likely shorter then it was before. That’s also the reason why the user might notice that it’s possible to get productive sooner, as the device will be available for use sooner.


More information

For more information regarding blocking devices until certain apps are installed, please refer to the following articles:

5 thoughts on “Block access to a device until specific apps are installed”

  1. I’ve set mine the same way you described, on mine I have Company Portal and Office 2016 set as required. In the ESP I have them both selected and set specified number of minutes to 90. The experience has been that the ESP remains on ‘Account Setup’ for a long period (15 minutes or so) with some devices then failing. I’ve left Office 2016 out of the mix and have recommended that it be installed manually from the Company Portal soon after device is ready. This new feature seems very unstable still.

    • Hi Miguel,
      It’s not this feature that makes it instable. It’s the fact that it now also tracks Office 365 ProPlus installations that makes the behavior less reliable at this moment (due to size, latency, etc.).
      Regards, Peter

  2. I tested this ESP feature with test account which seems work fine. Until.. I tried to login with administrator account without intune license/apps deployed on it.. during login it starts ESP and seems to be stuck forever. Have you seen this same problem? I really would want to use ESP but I really cant if it block administrator logins..


Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.