Today, some organizations use an EnterpriseEnrollment DNS CNAME record to automatically direct devices to the Microsoft enrollment service during Windows MDM-only enrollment.
Starting January 15, 2027, as part of our ongoing efforts to simplify and modernize enrollment experiences, Microsoft Intune will end support for CNAME-based auto-discovery in Windows MDM-only enrollment scenarios. This change reduces dependency on DNS-based discovery while providing a more consistent enrollment experience moving forward.
After this change, users may need to enter the Microsoft enrollment server URL if it’s not already provided by the enrollment experience:
https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svcWho this change affects
Your organization may be affected if:
- You use Windows MDM-only enrollment.
- You have configured an EnterpriseEnrollment DNS CNAME record.
- Your enrollment process depends on DNS record to automatically discover the enrollment service.
You likely aren't affected if you exclusively use:
- Microsoft Entra join enrollment
- Microsoft Entra hybrid join enrollment
- Other enrollment methods that don't rely on EnterpriseEnrollment CNAME discovery
How the user experience will change
Today, in affected environments, a user can begin Windows MDM-only enrollment, and the enrollment service is automatically discovered using the organization’s EnterpriseEnrollment DNS CNAME record. The user doesn’t need to provide the enrollment server information.
After this change, CNAME-based auto-discovery will no longer be used for these Windows MDM-only enrollment scenarios. If the enrollment service URL isn't already provided by the enrollment experience, the user will need to enter it when prompted. Enrollment can then continue using the Microsoft enrollment service URL. For example:
Figure 1: An example of how a user may need to enter the enrollment service URL.Identifying affected environments
Review your organization's DNS configuration and Windows MDM-only enrollment documentation.In particular, look for an EnterpriseEnrollment DNS record similar to:
EnterpriseEnrollment.contoso.comIf your organization configured the EnterpriseEnrollment record to support Windows MDM-only enrollment discovery, you should prepare for this change.
You should also review and update documentation that assumes enrollment service discovery happens automatically through DNS, including:
- Internal enrollment guides
- Help desk procedures
- Device deployment instructions
- Provisioning documentation
- User onboarding materials
Actions to take if you’re affected
To prepare for this change we recommend the following actions:
1. Identify impacted enrollment workflows
Review all Windows MDM-only enrollment scenarios used within your organization and determine whether they depend on EnterpriseEnrollment DNS discovery.
2. Update enrollment documentation
Update user guides, knowledge base articles, onboarding materials, and other instructions to reflect the new enrollment process.
3. Prepare support teams
Ensure help desk and deployment teams understand the change and know when the enrollment service URL may need to be provided.
4. Test enrollment scenarios
Validate affected enrollment workflows before the change takes effect. Identify any required updates and determine where users may be prompted to enter the enrollment service URL.
5. Communicate with impacted users
If users will need to enter the enrollment service URL, provide updated instructions before the change takes effect.
Frequently asked questions
Does this affect existing enrolled devices?
No. Existing enrolled devices remain enrolled and aren’t affected by this change.
Is Windows MDM-only enrollment being retired?
No. Windows MDM-only enrollment remains supported. Only CNAME-based auto-discovery will become unsupported.
Do I need to remove my EnterpriseEnrollment DNS record?
Review your environment and DNS configuration requirements. This change only affects use of the record for Windows MDM-only enrollment auto-discovery.
Will every user need to enter the enrollment service URL?
Not necessarily. Some enrollment experiences may already provide enrollment server information. Manual entry is only required when the enrollment experience doesn’t provide it automatically.
Should we begin testing now?
Yes. We strongly recommend validating enrollment scenarios as early as possible and updating relevant documentation before this change takes effect.
Next steps
Review your Windows MDM-only enrollment processes and identify any dependencies on EnterpriseEnrollment DNS CNAME records. Update enrollment guidance, deployment instructions, onboarding materials, and help desk procedures that assume the enrollment service will be discovered automatically through DNS.
Stay tuned to this blog for updates. If you have any questions, leave a comment below.
