Manage your Windows device in the same directory as your Android, iOS, and Linux devices. Go to Devices & Groups to view all the devices provisioned on your tenant. Then use the filters and views to find the devices you’d like to manage.
In this article:
- Managing Windows Devices with Blueprints
Managing Windows Devices with Blueprints
Blueprints control the desired state of the device. Think of a blueprint as the overarching controller for your device fleets. You can assign any number of devices to a blueprint, and every device is assigned one blueprint at a time. Blueprints are applied to a device when they are converged. Learn more about Blueprints and desired state.
When converging a Windows device to a blueprint, the blueprint converges to all accounts currently on the device.
To create a blueprint, go to Blueprint Manager and select Create Blueprint.
Apps & Configuration
In the blueprint, go to Apps & Configuration and click on the Windows tab.
Multi-app Mode
The Device mode function enables you to switch a device between Multi-App mode and Kiosk mode. When a device is in Multi-App mode, the end user can see and use all the approved apps on the device.
To add an application, click on Add Application.
Choose from the applications in Apps > Esper Windows Apps.
After adding the application, click on its ellipsis to manage its configurations or remove it from the list.
Windows apps added to a blueprint are always in the Show state, meaning they will always be displayed on the device home screen.
Kiosk Mode
To lock a device into a single application, select Kiosk Mode from the Device Mode dropdown. You'll then choose a Kiosk Method, which determines how Windows enforces the kiosk experience: Assigned Access or Shell Launcher.
Previously, this section supported only Win32 applications under a single method labeled Kiosk Mode. That method is now called Assigned Access and supports both Win32 and UWP apps. Shell Launcher is a new kiosk method that also supports both app types.
Shell Launcher replaces the Windows shell entirely, so the configured app runs as the only shell on the device. There's no desktop, taskbar, or Start menu. This makes Shell Launcher the recommended kiosk method for UWP apps, since it avoids the app-specific limitations you can run into with Assigned Access.
Kiosk Method
| Method | Supported app types | Windows edition requirement |
|---|---|---|
| Assigned Access | Win32 and UWP | All supported Windows editions |
| Shell Launcher | Win32 and UWP | Windows Enterprise editions only |
Note: Shell Launcher is supported only on Windows Enterprise editions. If the device isn't running an Enterprise edition, the console displays a message indicating this requirement.
Tip: For UWP apps, use Shell Launcher. Some UWP apps don't behave correctly under Assigned Access due to limitations in how the app itself is built, which is outside Esper's control.
Adding the kiosk application
For either method, click on Add Application to set the kiosk app.
Choose the application type:
-
Win32 Application: Enter Set App Name, Set Installation Path (the path where the application is installed on the device), and optional Arguments. The app must already be installed on the device before you set its installation path.
- You can select browser argument defaults for Google Chrome, Mozilla Firefox, and the Edge browser. Verify the kiosk experience on a test device before applying these changes fleetwide.
- UWP Application: Select an uploaded app from the Select Application dropdown. The app must already be uploaded under Apps > Esper Windows Apps and present in the installation list before you can select it as the kiosk app.
Once added, the kiosk app appears both in the Kiosk Method app list and in the Manage Applications list below it.
Applying the configuration
After you save the kiosk configuration and converge the blueprint to the device, the kiosk configuration doesn't take effect immediately. To apply it reboot the device, or sign the device user out and back in.
This is native Windows behavior and applies to both Assigned Access and Shell Launcher.
Note: If the configured kiosk app isn't installed on the device yet, Windows can't launch it. The device shows one of the following, depending on the kiosk method and app type:
| Kiosk method | App type | Behavior when the app is missing |
|---|---|---|
| Shell Launcher | Win32 or UWP | Blank black screen |
| Assigned Access | UWP | Blue screen indicating the app couldn't be found |
| Assigned Access | Win32 | Pop-up indicating the app couldn't be found |
These are native Windows behaviors and can't be overridden. If you see one of these screens, install the application on the device, then reboot or sign the device user out and back in to apply the kiosk configuration.
When a device is set to Kiosk Mode, the device user will need to sign out of the current account and sign into the Kiosk account. If the Kiosk account does not appear after the converge, reboot the device or sign out of the current account.
Once signed into the Kiosk account, complete the device set up to enter kiosk mode. Learn how to switch back to multi-app mode.
About Windows Managed Configurations
You can apply a managed configuration to a Windows MSI applications through a blueprint or via a group. When an MSI app is installed, you have the option to specify custom configurations as command line arguments. These arguments can be defined by your application developer. See Microsoft Standard Installer documentation for more information.
By default, the values are set to '/qn /norestart' which means the application installs silently and without a restart (recommended argument for MSI applications). For Windows applications, overrides apply on the next deployment of the application when the configuration is changed.
Connectivity
In the blueprint, go to Connectivity and click on the Windows tab.
Allow Bluetooth
Enable or disable Bluetooth connectivity on the device.
Wi-Fi Access Points
Add Wi-Fi access points to the device. When the device is in range of the listed network, it will use the credentials to access the network.
Click on Add Wi-Fi Access Point to add the network’s:
- SSID: name of the network.
- Security Type: None or WPA2.
- Hidden status: whether or not the network is hidden.
Once a network is added, click on the ellipsis (...) to edit access credentials or remove the network from the list.
Device Security
In the blueprint, go to Device Security and click on the Windows tab.
Factory Reset
When this is enabled, device users will be able to factory reset and wipe the device, effectively removing Esper management from it. We recommend keeping this disabled in production. This option should only be enabled for testing purposes.
If a device user attempts the Reset this PC option when this option is disabled, a message will appear informing them that the organization's policy doesn't allow it.
Display & Branding
In the blueprint, go to Display & Branding and click on the Windows tab.
Customize Home Screen Wallpaper
Change the device’s home screen wallpaper. Upload a wallpaper that doesn’t exceed 5 MB.
Customize Lock Screen Wallpaper
Change the device’s lock screen wallpaper. Set the lock screen wallpaper to the home wallpaper or upload a wallpaper that doesn’t exceed 5 MB.
After upload, click on See preview to adjust the wallpaper.
Wallpapers are not applied immediately after a converge.
-
Home screen- the wallpaper will appear the next time:
- the user signs into the account
- restarts of the device
- refreshes the device (Windows 11 only)
- Lock screen- the wallpaper will apply the next time the lock screen appears on the device.
Esper Settings
Custom OMA-URI Policies
Custom OMA-URI Policies let you apply SyncML/CSP (Configuration Service Provider) XML payloads directly to Windows devices. Use this when you need to configure a setting that isn't yet exposed elsewhere in the blueprint.
Check Microsoft’s Confiruation Service Provider documentation for a list of URIs and expected values for the settings you wish to configure.
To add a policy, in a blueprint, go to Esper Settings and click on the Windows tab. Then click on Add Custom Policy and fill in the following fields:
- Policy Name (required): A display name for the policy. Limited to 100 characters.
- Description (optional): A brief summary of what the policy does. Limited to 300 characters.
- Apply as atomic: Controls how multiple commands in a payload are sent. When enabled, all commands are bundled into a single SyncML transaction, and if any command fails, Esper rolls back the entire block instead of partially applying it. When disabled, only one payload can be sent at a time. Esper enforces this in the backend and UI, and blocks attempts to submit multiple payloads without atomic enabled.
- CSP Payload (XML) (required): The SyncML/CSP XML defining the commands to apply.
A CSP payload command includes:
- CmdID: An identifier for the command.
- Target/LocURI: The OMA-URI of the setting being configured.
- Meta/Format: The data type of the value being set (for example, int, chr, bool).
- Data: The value to apply to the setting.
Example:
<Replace>
<CmdID>1</CmdID>
<Item>
<Target>
<LocURI>./Device/Vendor/MSFT/Policy/Config/Settings/AllowDateTime</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">int</Format>
</Meta>
<Data>1</Data>
</Item>
</Replace>Esper rejects empty CSP payloads at the backend, and they aren't sent to the device. If an empty payload were to reach a device, it would simply fail rather than remove or affect any existing configuration.
Hardware Settings
In the blueprint, go to the Hardware section and click on the Windows tab.
Camera
Allow or prevent access to the device’s camera (if it has one).
Platform Services
In the blueprint, go to the Platform Services section and click on the Windows tab.
Windows Services
Allow Unenrollment from Device
Allow or prevent the device user from unenrolling from device management. When this option is enabled, the device user can unenroll from Microsoft device managed and Esper device management. We recommend keeping this disabled and only enabling it for testing purposes.
If this is disabled, the user will be prevented from removing the work or school account.
Scripts
In the blueprint, go to the Scripts section and click on the Windows tab. Use this section to add PowerShell scripts that run on the device when the blueprint converges. There are two types of scripts: Scripts and Background scripts. Scripts execute immediately. Background scripts can be set to run for a set amount of time.
Up to five scripts of either type may be added at a time. Script character limit: 16,600 characters.
Sequential script execution is not guaranteed. Up to five scripts can execute in parallel, meaning their execution order may vary. This limit was chosen to provide the best performance while being mindful of device resources. Design mutually exclusive scripts that don’t rely on the execution order of other scripts for the best results.
To add a script, click on Add Script and fill in the following fields:
- Script Name (required): A display name for the script. Limited to 100 characters.
- Description (optional): A brief summary of what the script does. Limited to 300 characters.
- Script body: The PowerShell script to execute on the device.
To add a background script, click on Add Background Script and fill in the following fields:
- Script Name (required): A display name for the script. Limited to 100 characters.
- Description (optional): A brief summary of what the script does. Limited to 300 characters.
- Script body: The PowerShell script to execute on the device.
Under Execution Settings, configure how the script runs:
- Always Run: When enabled, the script runs continuously without a frequency interval. Enabled by default.
- Frequency (mins): Available when Always Run is disabled. Sets how often the script runs. Must be a positive integer greater than 2 minutes.
- Timeout (mins): The maximum time allowed for the script to complete before it is stopped. Defaults to 60 minutes. Must be a positive integer.
Click Save Script to add it to the blueprint.
Note: Sequential script execution is not guaranteed. Up to five scripts can execute in parallel, meaning their execution order may vary. Design mutually exclusive scripts that don't rely on the execution order of other scripts for the best results.
You can check the status of background scripts in the device details Background Script tab.
System Updates
Defer Updates
Control how and when Windows updates are applied to your managed devices.
Quality Updates Deferral: Defer monthly patches Microsoft releases to address security vulnerabilities, bug fixes, and reliability improvements for up to 30 days.
Feature Updates Deferral: Defer major Windows version upgrades (often new OS capabilities and UI changes released periodically) for update to 365 days.
Quality Update Installation Deadline: Specify the number of days before quality updates are installed on devices automatically, for a maximum of 30 days. This acts as a hard deadline that overrides the deferral. Devices won't stay unpatched indefinitely.
Feature Update Installation Deadline: Specify the number of days before feature updates are installed on devices automatically, for a maximum of 30 days.
Pause all updates: Temporarily stop both quality and feature updates for up to 35 days. Take precedent over both quality and feature update deferrals.
Installation Behavior
Choose how updates are installed and when they are installed.
Allow Auto Update: Controls how Windows manages the full update lifecycle — scanning for, downloading, installing, and restarting after updates.
- Auto-install and restart (Default): Windows automatically downloads, installs, and restarts the device to complete updates.
- Notify before download: Windows notifies the user before downloading or installing updates. The user must take action for updates to proceed.
- Auto-install, notify to restart: Windows automatically downloads and installs updates, then notifies the user before restarting.
- Install and restart at scheduled time: Windows installs updates and restarts the device at the day, week, and time you specify using the scheduled install settings below.
- Auto-install and restart without user control: Windows installs updates and restarts the device automatically at the scheduled time, with no user prompts or controls.
- Turn off automatic updates: Disables automatic update installation. Updates must be triggered manually or through other management controls.
Scheduled Install Day: The day of the week when updates will be installed.
Scheduled Install Week: The week of the month when updates will be installed (first through fourth week). You can set a day without specifying a week, and vice versa. These settings work independently. When both are set, they combine to target a specific occurrence, such as the third Saturday of the month. If the device is unavailable at the scheduled time, installation is deferred to the following month.
Scheduled Install Time: The time of day when updates will be installed. Select a time outside of active device hours to minimize disruption.
Scheduled install settings are only available when Install and restart at scheduled time or Auto-install and restart without user control are selected. These settings are disabled for all other Auto Update options.
Active hours
Active hours let you protect a defined window of time from update-related restarts. Devices will not automatically reboot for updates during this period.
Note: Active hours apply to restart behavior, not to update downloads or installations. Updates may still download in the background during active hours; only the reboot is deferred.
Active Hours Start and Active Hours End work together to define this window. Set the start and end times to match your users' typical working hours to ensure restarts only happen outside of business hours.
Timezone
In the blueprint, go to the Timezone section and click on the Windows tab.
Set the device’s timezone.
Windows device management lets you manage Windows devices alongside Android, iOS, and Linux using Blueprints to define apps, security, connectivity, branding, and system settings in one place. Blueprints enforce a consistent desired state across all your devices supporting diverse use cases. Start managing Windows devices together with your Android, iOS, and Linux fleets for a unified, streamlined device management experience.