A new laptop sits on the blue Enrollment Status Page for an hour, then shows an error, or a user clicks past it into a half built desktop. It is one of the most common Autopilot problems, and in our experience it almost always comes down to one of three things. Here is how to tell which, and how to stop it.
What the ESP actually does
The Enrollment Status Page is the gate that holds a device during Autopilot while Intune applies policies, security settings and the apps you marked as required, before the user gets to the desktop. It runs in two phases: Device Setup, which happens before anyone signs in, and Account Setup, which happens after the first user signs in. If anything it is waiting for does not finish inside the timeout, the page either errors or, depending on your settings, lets the user through anyway. Most "stuck ESP" tickets are really "the ESP is waiting for something that is never going to arrive".
The three causes we see most
We root caused a run of these across a client fleet by pulling the diagnostic logs off three failing devices. Each one was a different cause, and between them they cover most of what you will hit.
1. An app that will never report installed. The commonest cause. The ESP is set to block on a required app, and that app has a detection rule that can never be satisfied, so the page waits forever. On one device it was Adobe Acrobat Reader with a detection rule pinned to a version higher than the installer actually delivered. The app installed fine, the rule said it had not, and the ESP waited until it timed out.
2. The network dropped for longer than the timeout. On another device, Device Setup stalled because the network was unreachable for nearly three hours, well past the ESP timeout. Autopilot needs a steady connection to pull policies and apps. A flaky wifi, a captive portal, or a VPN that is not reachable yet will all do this.
3. Nobody signed in, so Account Setup never ran. On a third, Device Setup finished cleanly and the device simply sat in Account Setup because no user ever signed in within the window. Account Setup only starts at the first user sign in. If a device is imaged and left on a shelf, it will look stuck when nothing is actually wrong.
How to read the logs
You do not have to guess which of the three it is. The device tells you if you collect its diagnostics. On the device, go to Settings, Accounts, Access work or school, click the account, Info, and Export your management log files, or run MdmDiagnosticsTool.exe -area Autopilot;DeviceEnrollment;TPM -cab C:\logs.cab from an elevated prompt. In Intune you can also collect diagnostics remotely from the device record.
Inside the bundle, the Intune Management Extension logs, IntuneManagementExtension.log and AgentExecutor.log, show each required app, when it was attempted, and crucially whether the detection rule passed. An app that installed but keeps re-evaluating as not detected is cause one. The autopilot and enrollment logs show the timeline of the two phases and where the timeout hit, which separates a network stall from an app stall. If Device Setup completed and Account Setup never started, that is cause three.
How to stop it happening again
Most ESP failures are self inflicted by a blocking list that is too ambitious. The fixes are straightforward once you know the cause.
- Only block on apps that genuinely must be present before first use, and keep that list short. Everything else can install after the user is working.
- Fix the detection rules. The rule must match what the installer actually produces, a real file version or registry value, not a hoped for one. Test the app on a clean machine and an upgrade before it ever goes near the blocking list.
- Give the timeout a realistic value for the slowest app and the slowest connection you expect, rather than leaving it at the default and hoping.
- Use Autopilot pre-provisioning (white glove) for heavy images, so the big apps land before the user ever touches the device.
- Make sure the device has a clean path to the internet during setup, no captive portal and no VPN dependency before enrolment finishes.
Get those right and the ESP does its job quietly: the laptop sets itself up, nobody in IT touches it, and the user signs into a finished desktop. That is the whole point of Autopilot, and it is part of what we run for clients every month.