3.3 KiB
title, description, ms.date, ms.topic, appliesto
| title | description | ms.date | ms.topic | appliesto | |
|---|---|---|---|---|---|
| Important considerations before deploying apps with managed installer | Learn about important aspects to consider before deploying apps with managed installer. | 03/07/2023 | tutorial |
|
Important considerations before deploying apps with Managed Installer
This article describes important aspects to consider before deploying apps with managed installer.
Existing apps deployed in Intune
If you have Windows 11 SE devices that already have apps deployed through Intune, the apps won't get retroactively tagged with the managed installer mark. The reason is to avoid making any security assumptions for these apps. You may need to redeploy the apps through Intune to get them properly tagged with managed installer and allowed to run.
Enrollment Status Page
The Enrollment Status Page (ESP) is compatible with Windows 11 SE. However, due to the E Mode policy, devices can be blocked from completing enrollment if:
- You have the ESP configured to block device use until required apps are installed, and
- You deploy an app that is blocked by the E Mode policy, not installable via a managed installer (without more policies), and not allowed by any supplemental policies or AppLocker policies
For example, if you deploy a UWP LOB app but have deployed a supplemental policy to allow the app, ESP will fail.
If you choose to block device use on the installation of apps, you must ensure that apps are also not blocked from installation.
:::image type="content" source="./images/esp-error.png" alt-text="Enrollment Status Page showing an error in OOBE on Windows 11 SE." border="false":::
ESP errors mitigation
To ensure that you don't run into installation or enrollment blocks, you can pick one of the following options, in accordance with your internal policies:
- Ensure that all apps are unblocked from installation. Apps must be compatible with the Windows 11 SE managed installer flow, and if they aren't compatible out-of-box, they either have the correspondent supplemental policy or AppLocker policy to allow them
- Don't deploy apps that you haven't validated
- Set your Enrollment Status Page configuration to not block device use based on required apps
To learn more about the ESP, see Set up the Enrollment Status Page.
Potential impact to events collected by Log Analytics integrations
Log Analytics is a cloud service that can be used to collect data from AppLocker policy events. Windows 11 SE device enrolled in an Intune Education tenant will automatically receive an AppLocker policy. The result is an increase in events generated by the AppLocker policy.
If your organization is using Log Analytics, it's recommended to review your Log Analytics setup to:
- Ensure there's an appropriate data collection cap in place to avoid unexpected billing costs
- Turn off the collection of AppLocker events in Log Analytics (Error, Warning, Information) except for MSI and Script logs
For more information, see Use Event Viewer with AppLocker