Using temporary enterprise feature control for early testing new features in Windows

This week is all about creating awareness around a recently new feature for controlling the availability of new features in Windows 11. That new feature is temporary enterprise feature control. Temporary enterprise feature control is introduced – together with permanent enterprise feature control – to manage the introduction of new features within the enterprise. With the continuous innovation that was recently introduced by Microsoft, new features are no longer only introduced with the latest feature update. New features are now already introduced with the Latest Cumulative Update (LCU), but are off by default. And new features with impact (like new experiences, new in-box applications, removing existing capabilities, or overriding previously configured settings) are behind that new feature, temporary enterprise feature control. New features behind that control will automatically be enabled with the annual feature update. Temporary enterprise feature update enables organizations to introduce those new features earlier and to verify the impact of those features within the environment. This post will look closer at configuring temporary enterprise feature control and experiencing that configuration.

Introducing enterprise feature control

The introduction of this post already provided some context around enterprise feature control, but it’s good to be familiar with a few more details. That starts with that features behind temporary enterprise feature control are automatically enabled with the annual feature update, or when a policy is applied that enables features behind temporary enterprise feature control. Either of those, will make sure that those features will be come available for the user. Besides that, there is also a more permanent method for enterprise feature control. That’s when a feature specific configuration is applied that specifically turns that feature off. In others words, there are basically two methods for an IT administrator to really control the availability of new features:

• Temporary enterprise feature control: This feature control can be used to turn on new features that are introduced with the LCA and that are turned off by default. This is basically an on/off switch for all new features that are introduced behind temporary enterprise feature control.
• Permanent enterprise feature control: This feature control can be used to turn on specific (new) features. This is basically referring to feature specific controls that can be used to turn that specific (new) feature on or off.

Besides all of that, there is also an indirect link with the option in Windows Update of Get the latest updates as soon as they’re available. That option enables the device to receive the latest Windows Configuration Update that will actually activate the new features that were introduced with LCU on the Windows device. That configuration can be applied by using the Allow Optional Content policy setting in Microsoft Intune. Once activated, those features are still behind temporary enterprise feature control. Alternatively, it’s always possible to simply wait until the latest Windows Configuration Update is automatically deployed.

Note: At the moment of writing the latest Windows Configuration Update is of September 26, 2023. That update activates features behind temporary enterprise feature control, like Windows Copilot and Dev Drive.

Configuring temporary enterprise feature control

When looking at the configuration of temporary enterprise feature control, to enable feature behind that control, it all starts with a new setting that was introduced within the February update for Windows 11. That new setting is the Allow Temporary Enterprise Feature Control policy setting in Microsoft Intune. That setting is based on one of the new policy settings in the Update section of the Policy CSP, being AllowTemporaryEnterpriseFeatureControl. That policy setting can be used to turn on or off features behind temporary enterprise feature control. The configuration of that policy setting is actually pretty straight forward, as the setting is already available within the Settings Catalog. The following eight steps walk through the creation of a Settings Catalog profile that contains the required setting to control the temporary enterprise feature control.

1. Open the Microsoft Intune admin center portal and navigate to Devices > Windows > Configuration profiles
2. On the Windows | Configuration profiles blade, click Create profile
3. On the Create a profile blade, provide the following information and click Create

• Platform: Select Windows 10 and later to create a profile for Windows 10 and Windows 11 devices
• Profile: Select Settings catalog to select the required setting from the catalog

4. On the Basics page, provide the following information and click Next

• Name: Provide a name for the profile to distinguish it from other similar profiles
• Description: (Optional) Provide a description for the profile to further differentiate profiles
• Platform: (Greyed out) Windows 10 and later

5. On the Configuration settings page, as shown below in Figure 1, perform the following actions

• Click Add settings and perform the following in Settings picker
  • Select Windows Update for Business as category
  • Select Allow Temporary Enterprise Feature Control as settings
• Select Allowed with Allow Temporary Enterprise Feature Control and click Next

6. On the Scope tags page, configure the required scope tags and click Next
7. On the Assignments page, configure the assignment and click Next
8. On the Review + create page, verify the configuration and click Create

Note: Not completely the scope of this blog post, but Figure 1 also provides an overview of the additional setting that is required to get Windows updates as soon as they’re available.

Experiencing temporary enterprise feature control

Experiencing the configuration of temporary enterprise feature control is pretty straight forward. After activating the latest features that came with the LCU – by getting the Windows Configuration Update – look at the availability of newly introduced features. That can be by looking at features like Windows Copilot, or Dev Drive. Basically, any feature that was introduced behind temporary enterprise feature control. However, so far, during testing, it seems to be only really applicable to features that don’t also have permanent enterprise feature controls. That makes the uninstall option for a Win32 app, from the right-click menu, probably the easiest way to fully test the behavior with turning it on and off. Below in Figure 2 is an example of a Windows device that has temporary enterprise feature control enabled (see bottom right), is still running Windows 11 version 22H2 (see top right) and has the uninstall Win32 app functionalities available (see left). That behavior can be triggered by right-clicking on a Win32 app in the start menu. That feature will actually show different behavior, depending on the configuration, and doesn’t have feature specific permanent controls.

Note: Keep in mind that Windows Copilot is not available at launch at my location. That’s why the icon is not showing on the taskbar, while temporary enterprise feature control is enabled.

More information

For more information about temporary enterprise feature control, refer to the following docs.

• Enterprise feature control in Windows 11 – What’s new in Windows | Microsoft Learn
• Update Policy CSP – Windows Client Management | Microsoft Learn
• Configure Windows Update for Business – Windows Deployment | Microsoft Learn
• Commercial control for continuous innovation (Windows 11) | Windows IT Pro Blog (microsoft.com)