How to Configure Automatic Intune MDM Enrollment | Auto Enrollment

Microsoft Intune to automatically enroll CYO or BYO devices. You can scope automatic enrollment to some Azure AD users, all users, or none. This is an old post, but the concepts are still the same.

There is an option in the old classic Azure portal to set up Automatic Intune MDM enrollment for Windows 10 devices. A similar option is available in the new Azure portal with new names and a new look. More details about Windows 10 Intune Auto Enrollment Process are explained in this post.

Intune Admin Portal is one of the first things you have to learn. From this post, you understand what is where in Intune admin portal. The official name of the Intune admin portal is the Microsoft Intune Admin Center.

Introduction

The Intune Auto Enrollment option will help you to perform two (2) things, as explained below in the video. It’s an old video now, the patch to configure auto-enrollment is changed a bit, and I have explained it in the new Intune portal walkthrough video below.

• First, whenever a Windows 10 device is joined to Azure AD, then the device will automatically get enrolled into Intune for MDM Management.
• Second, the allowed users in the MDM user scope group can enroll devices into Intune.

More Details about Intune Auto-enrollment using Group Policy are explained in the following document here. And the Quick Start Guide for Windows auto-enrollment document here.

NOTE! – For Windows 10 BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.

Windows 10 Intune Auto Enrollment Process

Following is the place where you can set the MDM enrollment configuration in the new Azure portal. When your MDM User scope is set to None, then none of the enrolled devices get the proper policies, and those devices won’t work as expected.

• In the Microsoft Intune admin center, choose Devices -> Device Onboarding – Enrollment -> Windows.
• Click on Automatic Enrollment button.

Select the MDM user Scope to All or Custom Azure AD group as per your requirement. If it is set to None, users won’t be able to enroll the devices into Intune management.

The simplest option is to specify “all users” in the MDM user scope so that all the users in your organization can enroll their devices into Intune. Windows 10 devices will be automatically enrolled to Intune when the users perform Azure AD Join.

User groups can manage this option. When you want to provide a specific group of users the ability to enroll their devices into MDM/Intune, this is the place to configure that user group. Click on the SOME option in the MDM User scope and select the user group you want to provide access to.

From the same place, you can perform a granular or phase-wise approach to move users to new MDM management. There are 3 URL options in this blade, you can configure these URLs as per your MDM vendor.

Video Windows 10 Intune Auto Enrollment Process

This is an old video recorded using the Azure portal UI. The concept is the same, but the options are different in the new portal UI.

Windows 10 Airwatch Mobileiron Auto Enrollment Process?

In case your devices are managed by Airwatch or Mobileiron, then you can specify those URLs. All the URLs are automatically configured in the new Azure portal for Intune MDM. There are 3 different URLs in this blade.

1. MDM Terms of use URL – The URL of the terms of use endpoint of the MDM service

https://portal.manage.microsoft.com/TermsofUse.aspx

2. MDM Discovery URL – This is the URL of the enrollment endpoint of the MDM service. The enrollment endpoint is used to enroll devices for management with the MDM service. The URL given below is the Intune enrollment endpoint URL.

https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

3. MDM Compliance URL – This is the URL of the compliance endpoint of the MDM service. When a user is denied access to a resource from a non-compliance device.URL can navigate to this URL hosted by Intune service in order to understand why their device is considered noncompliant. Users can also initiate self-service remediation so their devices become compliant and they can continue to access resources.

https://portal.manage.microsoft.com/?portalAction

So where is the option in new Azure portal to configure the MDM auto-enrollment setting for Windows 10 devices and MDM enrollment for rest of the devices (Android, iOS, and macOS)? Following is the place where you can configure Intune MDM enrollment option –  Microsoft Azure – Mobility (MDM and MAM).

Windows 10 Intune Auto Enrollment Process Screen capture.

Reference Link :-Windows 10, Azure AD and Microsoft Intune: Automatic MDM enrollment powered by the cloud! – here

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…