Device and Intune templates

Settings > Devices holds the templates applied to managed devices across customers. Defining them once here and assigning them per organization is what makes device management scale.

Screen	Defines
Intune Device Templates	Device configuration pushed through Intune
Intune Compliance Templates	What makes a device compliant, and what happens when it is not
Windows Autopilot Templates	How a new device provisions itself out of the box
Windows ESP Templates	The enrolment status page a user sees during that first setup
Device App Groups	Groups of applications deployed together

Windows Autopilot here is Microsoft's, not the MSPControl agent

These templates configure Microsoft Windows Autopilot — the out-of-box provisioning service. That is a different thing from MSPControl Autopilot, the endpoint agent, despite the shared name.

Both appear in this product and the collision is unavoidable, so check which one a procedure means before following it.

Templates are platform-level; assignment is per organization

These screens define the templates. The corresponding profiles under an organization’s Devices menu are where a template is applied to that customer’s devices.

Editing a template reaches every organization using it

A template is shared. Changing a compliance rule or a configuration value here propagates to every customer assigned that template, with no staged rollout.

Where one customer needs different behaviour, create a template for them rather than editing a shared one — the same discipline as hosting plans.

Compliance templates deserve particular care

A compliance template does not merely report; depending on configuration it can restrict what a non-compliant device may reach.

A tightened compliance rule can lock users out of their own resources

Devices that were compliant yesterday can fail today because the rule changed, not because anything on the device did. To the user that presents as suddenly losing access to mail or files, with no explanation.

Change compliance rules in a maintenance window, on one organization first, and tell the customer what users will see if their device falls out of compliance.

Enrolment status pages

An ESP template controls what a user watches during first setup — and, importantly, whether they are blocked until provisioning finishes.

A strict ESP turns a slow provision into a support call

Blocking the user until everything installs is defensible, but it means a slow or failing install leaves someone staring at a screen they cannot dismiss. Set a realistic timeout and decide deliberately what happens when it is reached.

Related

• Devices — where templates are assigned
• MSPControl Autopilot — the endpoint agent, a different product
• Device settings and commands