Forum Discussion
Auto Enrollment Intune devices already azure AD joined?
Hi William,
the problem is if you enable both enrollment user scopes and when they overlap the MAM scope will take precedence. I guess this is your problem, I've seen this very often.
see here: https://docs.microsoft.com/en-us/intune/windows-enroll
Important
If both MAM user scope and automatic MDM enrollment (MDM user scope) are enabled for a group, only MAM is enabled. Only MAM is added for users in that group when they workplace join personal device. Devices are not automatically MDM enrolled.
to avoid this and get your MDM auto-enrollment working you can either disable the MAM user scope or you enable All for MDM user scope and assign a specific group for MAM user scope. Additionally keep in mind the MAM user scope is not for general MAM on iOS or Android, it is for the MAM Windows feature. It's the Windows Information Protection feature basically.
best,
Oliver
Hello Oliver,
It is only MDM user scope that is enabled and not MAM.
I just noticed that they have Intune clinet installed :/ I have to remove the devices from the console first.
Thanks!- I’m having the same issue , which devices did you move under what section in azure ? I have devices already enrolled into azure ad and trying to get them to enrol into Intune . Under accounts in settings I select enrol only in device management and it doesn’t install the Intune Management Extension. So question is what is the best way to enrol a device into Intune that is already azure ad joined ? Btw license is Microsoft 365 business . And oobe works for brand new devices and Intune Management Extension is working for those devices
Good news to all, the "Intune In Development" site does list a feature which will be released soon that solves the agent install on devices not auto-enrolled, see here:
Configure your Win32 apps to be installed on Intune enrolled Azure AD joined devices
You'll be able to assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices. For more information about Win32 apps in Intune, see Win32 app management.
best,
Oliver
Oliver Kieselbach wrote:Hi William,
the problem is if you enable both enrollment user scopes and when they overlap the MAM scope will take precedence. I guess this is your problem, I've seen this very often.
see here: https://docs.microsoft.com/en-us/intune/windows-enroll
Important
If both MAM user scope and automatic MDM enrollment (MDM user scope) are enabled for a group, only MAM is enabled. Only MAM is added for users in that group when they workplace join personal device. Devices are not automatically MDM enrolled.
to avoid this and get your MDM auto-enrollment working you can either disable the MAM user scope or you enable All for MDM user scope and assign a specific group for MAM user scope. Additionally keep in mind the MAM user scope is not for general MAM on iOS or Android, it is for the MAM Windows feature. It's the Windows Information Protection feature basically.
best,
Oliver
Superb and very informative answer Oliver
