10-05-2018 01:23 PM
10-05-2018 01:23 PM
10-06-2018 02:14 AMSolution
auto-enrollment is not supported when not used with OOBE and AADJ. But you could use an approach to guide users to MDM enrollment by sending out deep links via email for example. See here:
11-04-2018 04:52 PM
so what should companies which are long using AAD joined devices and want to start using Intune leveraging the Intune Management Extension do?? since the extension is only installed once MDM is Auto Enrolled and the MDM cannot be auto enrolled because the client is already joined to Azure AD.
Whats the best solution for that?
12-19-2018 02:35 AM
may you PM me some more details about how many devices are blocked by this and some more details. This would be helpful for MS.
12-28-2018 04:12 AM
I have similiar case here. We have around 40 laptop users using O365 and devices are connected to Azure AD. Now I want to deploy M365 and Intune for them. I have upgraded users subscription to M365 and Windows version has been upgraded automatically to Windows 10 business as should. Computers won't pop-up automatically to Intune… I have read that I should cut the current connection to Azure AD from each Workstation and re-join devices again manually to Azure AD. I have tested this and computers will pop-up in Intune. This will do the trick, but isn't there a simpler way?
12-28-2018 05:45 AM
12-28-2018 11:05 AM
Haven't had a chance to try this out in my lab, but it looks like enrolment can be triggered with Group Policy "starting Windows 10, version 1709 you can use a Group Policy to trigger auto-enrolment to MDM for Active Directory (AD) domain joined devices."
"When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. "
Hope this helps!
12-28-2018 11:37 AM
12-28-2018 01:22 PM
Ok... so to make sure I'm following your scenario :)
You have a large deployment of W10 machines in Workgroups (not joined to on-prem Active Directory), which have been Azure device joined (not Hybrid/ADDJ) and you want trigger Intune auto-enrolment?
12-28-2018 01:29 PM
12-29-2018 12:15 PM
Spent some time testing your scenario in my lab, and as suspected, you don't need to leave AAD and rejoin to trigger silent auto-enrolment :)
Please start another thread, tag me and we'll walk through my results.
12-30-2018 07:38 AM
Matt, could you please post your method here in this thread, since it's where the question was originally posted?
01-04-2019 09:19 AM - edited 01-04-2019 09:46 AM
Auto-Enrolment can be triggered using local policy. Please ensure users are logging into Windows using their Azure AD credentials, the device is Azure AD joined and users have been assigned Intune licenses.
Local policy can be configured using GPEdit.msc or applying the registry key below. Agreed this doesn't help in scenarios where you have roaming users, however the reg key could be deployed using PowerShell when users visit the Office.
** Tested using W10 - 1809
01-14-2019 06:09 AM
currently the supported way is to re-join to trigger Intune Management Extension installation via auto-enroll. The only thing I can tell is the product group is aware of this. No information if it will change but they are aware.
01-14-2019 06:57 PM
Thanks for the reply Oliver. I was just looking for an official confirmation that this is the only supported way. Its going to be tough tell that to our clients but it is what it is.
01-21-2019 07:20 AM
Hello, if its for Autopilot you can try that what Robin posted in his Blog:
01-29-2019 03:09 PM
thanks for your reply but that doest work because the devices are currently not managed by Intune
"For this blog I have the following assumptions;
Imagine a following scenario, a company which is cloud only and all the devices (hundreds) are joined to Azure AD. They never seem the benefits of Intune before so the MDM was never configured. Now they are getting into the idea of managing these devices via Intune only and leverage the App Distribution provided by Intune (which requires Intune Management Extension). The only way the Management Extension is installed automatic is when the device is joined to Azure AD. So for this company be enabled with Intune and the Mgmt Extension they need to manually re-join all its devices to Azure AD.
That is Sadly the only way it currently works.
02-13-2019 04:25 PM
I am running into this exact same scenario. The previous director of IT only enrolled in the office 365 plan with Azure Active Directory, and we now want to use MDM with InTune and its turning out that we can't because everyone is already signed into Azure Active Directory
02-13-2019 05:13 PM
02-13-2019 06:05 PM
02-14-2019 01:24 PM
This would require a reset to implement for intune enrollment, probably out of the OP's scope.
02-25-2019 06:41 AM
I have hundreds of laptops which I need to enrol to intune. I have set up the gpo to auto enrol but all they appear is under Azure AD Devices and not under All devices. I need them under all devices so that I can manage them. If I download the company portal and follow the steps then the laptop gets enrolled however I want this to be transparent and automatically enrolled. Any help??
02-25-2019 07:20 AM
please have a look at "Scenario 8" in the article "Managing Windows 10 with Intune – The Many Ways to Enrol", you need to set two different GPOs, one that controls hybrid AAD join and one that controls Intune MDM enrollment:
Managing Windows 10 with Intune – The Many Ways to Enrol
Enroll a Windows 10 device automatically using Group Policy
02-25-2019 07:35 AM
Interesting read @Oliver Kieselbach
My Devices are all domain joined on a local on prem DC and then we use the work account for authentication. In fact if I run dsregcmd /status this is what I get
AzureAdJoined : NO
EnterpriseJoined : NO
DomainJoined : YES
02-25-2019 11:56 PM
02-26-2019 12:00 AM
Yes I have configured auto enrolment to a specific group. I then configured the MDM gpo to auto enrol also. My devices are all local AD joined and have a work O365 account linked to the PC. I deleted the PC from under AD Azure Device, formatted the PC and once back up it re appeared under AD Azure PC but not under all devices.
02-26-2019 09:26 AM - edited 02-26-2019 09:35 AM
This might be the solution for our problem at least for small organizations ->
Check out the section:
02-26-2019 11:49 PM
By running that I didnt need to have the portal installed and neither did the user need to be an admin to enrol. Is there a way to automatically enrol the device automatically and skipping the manual steps?
02-26-2019 11:55 PM
04-05-2019 11:52 AM
Good news to all, the "Intune In Development" site does list a feature which will be released soon that solves the agent install on devices not auto-enrolled, see here:
You'll be able to assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices. For more information about Win32 apps in Intune, see Win32 app management.
06-12-2019 05:40 AM - edited 06-12-2019 05:41 AM
Did you ever find a solution to automate the "Enroll only in device management" button?
After days of searching, finally I found a way to get powershell scripts on my AD REGISTERED (not joined) machines... and it's by using this "Enroll only in device management" button. For some reason this is different than adding your account with auto-enroll set up.
Now, my machines receive MDMFull instead of MDMFullWithAAD and I can manually install the Intune Management Extension and get powershell scripts.
Now if I could just apply this to my users automatically without removing them from AD and rejoining them manually. Any tips? Thanks
06-13-2019 07:03 AM
Existing AAD Device - try bulk enrollment - it will probably rejoin the device to AAD but after a few days, I believe the records will merge. Be patient.
Bulk enrollment requires you to send a .ppkg manually to each device that is already enrolled. Not really an option.