Enrollment Status Page not assigning correctly

Question

I have two separate tenants that get the same exact issue.  I create two dynamic groups:

 

Two Dynamic Security Groups

Autopilot Entra Join - looks for ZTDID device (i.e. - device is in autopilot devices) and does not have the group tag HYBRID assigned. 

Autopilot Entra Hybrid Join - looks for group tag HYBRID

 

Two Autopilot profiles:

Autopilot Entra Join - assigned to Autopilot Entra Join dynamic security group.

Autopilot Entra Hybrid Join - assigned to Autopilot Entra Hybrid Join dynamic security group.  

 

1. Enroll device in to Autopilot using PowerShell.  
   1. Dynamic Security Group assignment works fine and device is added to Autopilot Entra Join security group_._  
      1. A_utopilot Entra Join_ Autopilot profile gets assigned.  
      2. Add the HYBRID group tag
         1. Device is removed from Autopilot Entra Join security group.  
            1. Device is assigned to Autopilot Entra Hybrid Join security group
               1. Autopilot Entra Hybrid Join Autopilot profile gets assigned.    

The issue is with assigning the Enrollment Status Page.  It is not assigning correctly and just using the default ESP.  I had two ESP's last week and deleted both and rebuilt and only used one ESP and assigned to the Autopilot Entra Join security group and it started working. 

 

Today, I added Autopilot Entra Hybrid Join security group to the assignment.  Same issue I had early on Friday occurs and the Autopilot Entra Join ESP is not assigned.  Instead it uses the default ESP.

 

Easy solution is to just modify the default ESP, but we should not have to do that.  

 

I cannot be the only person this is happening too??

Answer 1

@Matt Dillon, Thanks for posting in Q&A.

From your description, I know you have assigned two custom ESP profile but did not work.

Based on my research, a user or device can have many ESP profiles. If this happens, multiple profiles can be applied to the user or device. This can cause conflicts among settings. To handle this, ESP can have a priority. Only the highest priority profile is applied to the enrolling devices.

https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-enrollment-status#prioritize-profiles

And also, I noticed that you have removed devices from Autopilot Entra Join security group and added it to Autopilot Entra Hybrid Join security group and add HYBRID group tag, so there can be inherent delays in membership updates, especially when attributes like group tags are modified. This delay might cause devices to receive the default ESP instead of the intended custom ESP during enrollment.​ We can wait for some time and reassign the ESP profile, then do Autopilot to see if the issue can be fixed.

Please try above information, if there is any update, feel free to let me know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.