How to Prevent Applications from Installing During Autopilot OOBE
Windows Autopilot with Intune is a powerful way to provision devices, but let's be honest—it can occasionally feel unreliable. In most cases, however, Autopilot itself isn't the problem. The real issue often comes from applications that are being installed during the Enrollment Status Page (ESP) phase of the deployment.
A common example is endpoint security software such as CrowdStrike. During installation, the initial agent may deploy successfully, but then immediately attempt to update itself to a newer version. When applications perform additional actions like updates, service restarts, or post-install configuration during ESP, they can interfere with other app installations and ultimately cause Autopilot deployments to fail or become stuck.
Fortunately, there are ways to prevent certain applications from installing during the Autopilot Out-of-Box Experience (OOBE) and instead defer them until after provisioning is complete.
One option is to use Windows Autopilot Device Preparation, which allows you to better control the deployment experience. However, this method is currently only supported for Microsoft Entra joined devices. For organizations that still rely on Hybrid Entra Join—and despite Microsoft's recommendations, many organizations still do—another approach is needed.
In this article, I'll show you how to use an Intune Requirement Rule combined with a PowerShell script to prevent specific applications from installing while a device is still in the OOBE/ESP phase.
How It Works
The solution uses a custom requirement rule that checks whether the device has completed the Windows Out-of-Box Experience.
The script returns:
0 = Device is still in OOBE/ESP
1 = OOBE is complete
By configuring the Intune requirement rule to only allow installation when the script returns 1, the application will be skipped during Autopilot and installed later after provisioning has finished.
Step 1: Create the PowerShell Script
Copy the following script and save it as a .ps1 file.
Step 2: Configure an Intune Requirement Rule
Open the Intune application that you want to delay during Autopilot.
This can be done either:
While creating a new Win32 application
After an application has already been uploaded to Intune
Navigate to the Requirements tab.
Step 3: Add a Script Requirement
Under Configure additional requirement rules, select + Add.
Configure the requirement using:
Requirement type: Script
Upload the PowerShell script created earlier
Configure the script settings to match the example below
Step 4: Configure the Expected Value
When configuring the requirement rule, set the expected Value to: 1
This is the key piece of the configuration.
Because the script returns 0 while the device is still in OOBE and 1 after OOBE has completed, Intune will block installation until the requirement evaluates successfully.
What Happens During Autopilot?
During the Autopilot provisioning process, Intune will still evaluate the application assignment. However, before the installation begins, it first executes the requirement rule script.
If the device is still in OOBE, the script returns: 0
Since the application is configured to require a value of 1, Intune determines that the requirement has not been met and skips the installation.
This prevents the application from interfering with ESP and reduces the chances of provisioning failures caused by complex installations, self-updating software, security agents, or applications that require multiple service restarts.
What Happens After Autopilot Completes?
Once the device finishes Autopilot and exits the OOBE process, Intune will evaluate the application assignment again during the next policy check-in.
At that point, the script returns: 1
Because the requirement is now satisfied, Intune proceeds with the application installation.
Considerations
The biggest tradeoff with this approach is timing. Applications don't install immediately when Autopilot finishes. Instead, they must wait until the device performs another Intune policy evaluation.
In my testing, most applications installed fairly quickly after:
A reboot
User sign-in
The next Intune sync cycle
Typically, delayed applications began installing within about an hour after provisioning was completed.
For organizations experiencing Autopilot issues caused by complex or self-updating applications, this simple requirement rule can be an effective way to improve deployment reliability while still ensuring the applications are installed shortly after the device is ready for use.
