Delaying installation of applications during Autopilot provisioning

If you provision devices using Autopilot, then you may have dealt with situations like delaying installation of certain applications to address provisioning requirements or simply get the process over the line. I recently had to deal with a something similar involving Zscaler in a customer's tenant. Installation of the application would halt the provisioning process, regardless of whether it installed in device or account setup phase. This is because the way Zscaler policy was configured in the customer's tenant which required user credentials before allowing access to internet. 

Back in the day, if you were using ConfigMgr, then this could be addressed by creating a dynamic collection that would populate with the devices based on the completion status of an imaging task sequence. You would then target the same collection with such apps or scripts as post installation tasks. With Intune, the same isn't really possible using the native functionality and one has to come up with clever ways to achieve the desired end state. One can add dependencies, but that may still get in the way of the provisioning. You can possibly create a schedule task of some sort that kicks of the installation at a set interval or particular user action. Perhaps running a remediation script to look for a configuration on the device and then kicking off the installation? But, none of these really give me the confidence and so I had to think out of the box. Luckily, in my case, I was also enabling and managing Windows Hello for Business as part of the provisioning process. That is when it struck me. Wouldn't it be simply lovely if I could tie down the installation of Zscaler to Windows Hello for Business, as it would pretty much be the last step in the provisioning step? After doing a bit of  research, I came to the conclusion that this is absolutely possible. This is how I went about setting this up.

You see, when Windows Hello for Business is registered with Entra ID tenant, it creates and Event ID 300 event under Applications and Service Logs\Microsoft\Windows\User Device Registration\Admin. Something similar to the one below -

Source: Microsoft Azure Device Registration Service

Version: 10 or 11

Message: The NGC key was successfully registered. Key ID: {<Key ID>}. UPN:test@contoso.com. Attestation: ATT_SOFT. Client request ID: . Server request ID: <Server Request ID>.

Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"}

Using Get-WinEvent, we can capture this event and use the output as a requirement in a Win32 Intune application. This approach can be used for any application that you want to install separately outside of the Autopilot provisioning or simply in general. Here’s the script that I put together -

$Winevents = Get-WinEvent -FilterXml "<QueryList><Query><Select Path='Microsoft-Windows-User Device Registration/Admin'>*[System[(EventID=300)]]</Select></Query></QueryList>" -ErrorAction SilentlyContinue

If ($Winevents.Count -gt 0) {

Write-Host "Microsoft Passport key was successfully registered with Azure AD"

}

ElseIf ($Winevents.Count -eq 0) {

Write-Host "Microsoft Passport key has not successfully registered with Azure AD"

}

Now, we just add this as a script in the requirement section of the Win32 Intune app. It should look something like the screenshot below -

Notice the output data type? We are basically looking for String - "Microsoft Passport key was successfully registered with Azure AD" and when satisfied, the installation of the application will run.

That's it. The Zscaler application will install after Windows Hello for Business is configured by the end user. This is evident by the time stamps in the event viewer and the Intune agent execution log.

Windows Hello for Business registered at 11.02 am

At the next sync, the installation of Zscaler is kicked off at 11.33 am and the requirement script is executed successfully.

Zscaler finishes installing at 11.44 am.

All was good with the world again. :-) Until next time..