IT SBIT Services
Schneeberger
DEEN
Known update issues

Windows Autopilot: blocking apps in user-targeted ESP profile ignored during device ESP

WorkaroundKnown issue

← All entries

Summary

Blocking apps defined in an Enrollment Status Profile (ESP) that is targeted at users are ignored during the device ESP phase. The services cannot determine the correct ESP profile because the user identity is not yet known. Microsoft documents a workaround; no fix is announced yet.

Symptoms

Apps configured as blocking in a user-targeted ESP profile do not block the device ESP phase. Enrollment may continue before these apps are installed.

Affected

  • Windows Autopilot deployments using an Enrollment Status Profile targeted at users with a list of blocking apps

Workaround

  1. Enable the default ESP profile (it targets all users and devices).
  2. Place the list of blocking apps in the default ESP profile.
  3. To avoid the issue, target ESP profiles to device groups instead of users.

Fix

Not fixed yet.

Recommendation

Review your ESP profiles. If blocking apps are defined in a user-targeted profile, move them to the default ESP profile or retarget the profile to device groups, then test with a new enrollment.

Sources

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 18:25.

Where the information comes from

We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:

  • Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
  • other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
  • community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
  • targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
  • early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online

Summary and translation with AI (Claude by Anthropic) – without any data of visitors.

Affected? We can help.

We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.

Get in touchRSS feed