Forum Discussion
problem with Auto-Enrollment for windows devices in Hybrid enviroument
Hi everyone,
I am in the process of setting up Intune for automatic enrollment on Windows devices within our hybrid environment. Here are the steps I have taken so far:
1. Configured Entra ID sync to synchronize a selected OU with Entra ID.
2. In the Intune Portal, set the Automatic enrollment MDM user scope to "All."
3. Created a GPO linked to that OU, which includes the settings to "register domain-joined computers as devices" and "Enabled automatic MDM enrollment using default Azure credentials" based on User Credential.
4. Prepared a clean computer, free of any software, and joined it to the Domain (on-prem server).
5. Moved the computer to the appropriate OU for syncing with Entra ID.
6. At this point, I can see the computer listed in the Entra ID portal under devices as Entra Hybrid joined
7. A regular domain user with a Business Premium license logged into the computer.( Only sign-in to windows, we don't have office app or add this account to windows.)
8. I ran GPupdate /force and rebooted the computer several times, but it still does not appear in the Intune portal.
9.Windows client is windows 11 Pro version 25H2 OS build 26200.8893
Dsregcmd output shows:
✅ Device is domain joined
✅ Device is synced to Entra ID
✅ Device authentication is working
✅ User has a valid PRT (Primary Refresh Token)
✅ Hybrid Join is successful
On second test computer2, I installed office desktop app, then sign-in with test user to activate it. After few minutes the computer appeared on Intune portal. but on test computer 1 without user's interaction, it doesn't show up.
would you be able to help me with this? Does it really need user to attach his/her account manually to "work or school account" or sing-in to any office desktop apps?
5 Replies
Hi,
Please perform the below steps to manually re-trigger Intune enrollment:
- Open Task Scheduler and navigate to:
Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt. - Note down the Enrollment GUID (folder name).
- Open Registry Editor and remove the enrollment registry entries for the same GUID from:
- HKLM\SOFTWARE\Microsoft\Enrollments\<GUID>
- HKLM\SOFTWARE\Microsoft\Enrollments\Status\<GUID>
- HKLM\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\<GUID> (if present)
- Delete the corresponding EnterpriseMgmt scheduled tasks for the same GUID.
- Restart the device.
- Run gpupdate /force from an elevated Command Prompt.
- Sign out and sign back in with the licensed domain user.
- Wait 5–10 minutes and verify whether the device appears in the Intune portal.
Please let me know the results.
I tested the whole process with a new computer, but still same problem.
I followed your steps on the new one, but it didn't work.
what is not working:
- No EnterpriseMgmt scheduled task
- No Intune enrollment certificate
- Not showing in Intune
any idea?
I tested the auto-enrollment on a new computer. after joining to the domain, synced with entra id and force gpupdate to get GPO..... still same problem.
what is working:
Hybrid Entra joined
-Receiving the auto-enrollment GPO
-Seeing the Intune MDM endpoint
-Getting an Azure PRT -
-Appearing in Entra ID
what is not working:
-No EnterpriseMgmt scheduled tasks
-No Intune enrollment certificate
- Open Task Scheduler and navigate to:
To configure a hybrid Microsoft Entra ID join using Microsoft Entra Connect, you must provide Hybrid Identity Administrator credentials for the cloud tenant and Enterprice Administrator credentials for your on-premises Active Directory forest. These credentials allow the wizard to automatically create and configure the Service Connection Point
Hi,
I already configured this. but still doesn't work.
