Why your Autopilot devices sit on the Enrollment Status Page
The ESP is where Autopilot goes to die. Nearly every stall comes down to one of five causes, and none of them are mysterious once you know where to look.
A device that sits at "Identifying" or "Preparing your device for management" for forty minutes is the most common Autopilot complaint I get. The person watching it assumes something is broken. Usually nothing is broken; the device is waiting for something that was never going to arrive.
Here are the five causes I see over and over, roughly in order.
1. The profile hasn't been assigned yet
"Identifying" means the device is checking whether it has an Autopilot profile. If the hardware hash was uploaded five minutes ago, the profile assignment can take a while to catch up, and the device will keep asking. Check the device in Intune under Windows Autopilot devices; the profile status should say Assigned, not Pending. If it is pending, wait, don't rebuild.
2. Too many apps are blocking
The ESP tracks the apps you tell it to track, and it won't let the user through until they're installed. The default is all required apps. On a fleet with twenty required Win32 apps, that's twenty installs, some with dependencies, some with detection rules that misfire, all before the user sees a desktop.
Pick the three or four apps the person needs to be productive in the first hour (the security agent, the VPN client, the browser) and block on those only. Everything else installs in the background once they're in.
3. A detection rule that never comes true
An app that installs fine but whose detection rule looks for a version string that doesn't match will report as failed, and the ESP will wait for a retry that fails the same way. Test detection rules on a machine that already has the app, before you make the app blocking.
4. Hybrid join waiting on a domain controller
Hybrid Entra join during Autopilot needs line of sight to a domain controller for the device to finish the join. If the device is at someone's kitchen table, it doesn't have that. The ESP sits there, and so does the user.
If you are still doing hybrid join for new devices, this is the moment to ask whether you need to. Entra-joined with Intune, plus Cloud Kerberos Trust for the things that still need on-premises access, is a simpler device that doesn't stall.
5. The timeout is doing its job
The ESP has a timeout, 60 minutes by default. When it fires, the user gets an error and the device is left half-configured. People read this as the cause; it's the symptom. Something above took longer than an hour.
Where to look
- On the device, during the ESP:
Shift+F10opens a command prompt. The log worth reading isC:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log. It shows which app it is waiting on and why. - In Intune: Devices > Monitor > Autopilot deployments shows each phase and how long it took, which tells you where the time went across the fleet rather than one machine.
- Turn on Show app and profile configuration progress in the ESP profile if it is off. People tolerate a wait they can see.
The settings I ship
For most customers: ESP on, show progress, block on three apps, timeout 60 minutes, don't allow the user to reset the device on failure (they'll just do it again), and a plain-English message that tells them who to call. The rest is making sure those three apps always install.
Autopilot is a good tool. It just does exactly what it's told, and the ESP is where you find out what you told it.
Written from the field, not a lab. If something here has changed since, it probably has; the newer posts are the place to look.