Autopilot ESP and Intune Win32 app dependency sequencing during enrollment

Question

Integration boundary: Autopilot Enrollment Status Page ↔ Intune Win32 app deployment
The Enrollment Status Page (ESP) in Windows 11 Autopilot is designed to block user access until all required apps and policies report a successful state. However, Win32 applications packaged as .intunewin files are processed by the Intune Management Extension in parallel by default, regardless of dependency metadata declared in the Intune portal. This creates a race condition when one Win32 app (for example, a Visual C++ runtime) must be fully installed and registered before a dependent application installer runs.
Documentation confirms that app dependencies can be defined in Intune, yet the ESP does not enforce a topological sort; it tracks each app independently and may report overall success before prerequisite components finish. The behavior has been observed in Windows 11 22H2 and 23H2 (build 22631) with Intune service version 2406, and no official sequencing guarantee has been announced. Workarounds such as chaining apps via PowerShell or bundling multiple install steps into a single .intunewin package increase packaging complexity and obscure per-application reporting in the Intune portal.
Given that parallel installation can succeed on fast hardware but fail under load, making reproduction non-deterministic, the core uncertainty is whether the platform intends to support declarative dependency ordering for Win32 apps during ESP or expects administrators to manage sequencing externally.

Does the current ESP implementation in Windows 11 23H2 provide any mechanism to enforce install-order guarantees for Win32 apps with declared dependencies?
If not, is there a supported pattern—short of custom scripting or monolithic packages—that ensures prerequisite Win32 apps complete before dependents start during Autopilot enrollment?

Zoha · Answer

Autopilot ESP Win32 Dependency Sequencing During Enrollment
The Enrollment Status Page (ESP) in Windows 11 23H2 reports each application’s installation state independently, and the Intune Management Extension processes .intunewin packages in parallel by default, regardless of any dependency metadata declared in the Intune portal. This creates a race condition: a dependent Win32 app (for example, a line-of-business installer) may begin installation before its prerequisite, such as a Visual C++ runtime, finishes registering. Consequently, ESP may report overall success before prerequisite components complete, and the user gains access without the intended dependency being fully present.
Confirmed facts:

IME processes Win32 packages in parallel during ESP by default.
  Dependency metadata in the Intune portal is currently informational only and does not influence ESP install‑order enforcement.
  Race conditions have been observed on Windows 11 22H2 and 23H2 (build 22631) with Intune service version 2406, where ESP reports success prematurely.
  Microsoft has not announced any feature guaranteeing topological ordering of Win32 apps during ESP.

Likely explanation: The platform expects administrators to manage sequencing externally, as no intra‑ESP ordering guarantee is implemented.
Supported pattern short of custom scripting or monolithic packages: Currently, no intra‑ESP pattern provides ordering guarantees. Workarounds such as PowerShell chaining or bundling multiple install steps into a single .intunewin package increase packaging complexity and obscure per‑application reporting in the Intune portal. The recommended approach is to defer dependent app installation until after ESP completes, using a post‑enrollment PowerShell script or a provisioning package that runs after the Enrollment Status Page finishes.
powershell
Get-EventLog -LogName Application -Source 'IntuneManagementExtension' | Where-Object { $_.Message -match 'Install.*Win32' } | Sort-Object TimeGenerated | Select-Object TimeGenerated, Message

If your enrollment logs show the prerequisite app finishing before the dependent starts, the race condition is confirmed in your environment, but the recommended sequencing path remains external to ESP.

Autopilot ESP and Intune Win32 app dependency sequencing during enrollment

Integration boundary: Autopilot Enrollment Status Page ↔ Intune Win32 app deployment

1 answer

Autopilot ESP Win32 Dependency Sequencing During Enrollment

Your perspective belongs here.

0 question comments