Intune auto MDM enrollment for devices already Azure AD joined?

[MTSBob]

I have a client whose fleet of Windows 10 PC's are already joined to their organizational AAD (company-ownership), without any MDM, but now would like to start using Intune. They've upgraded their licenses to AAD premium and EMS, so that they could use Intune MDM for these devices - and take advantage of MDM auto-enrollment going forward. However, is it possible to get their existing non-MDM devices to "auto enroll" into Intune, even though they are already AAD joined (prior to them getting Intune)? I can only find auto-enrollment scenarios working at AAD join time, not after the fact.

[#2 · Accepted solution]

Hi Bob,

auto-enrollment is not supported when not used with OOBE and AADJ. But you could use an approach to guide users to MDM enrollment by sending out deep links via email for example. See here:

https://docs.microsoft.com/en-us/windows/client-management/mdm/mdm-enrollment-of-windows-devices#con...

best,

Oliver

[#3]

Hi Oliver,

so what should companies which are long using AAD joined devices and want to start using Intune leveraging the Intune Management Extension do??  since the extension is only installed once MDM is Auto Enrolled and the MDM cannot be auto enrolled because the client is already joined to Azure AD.

Whats the best solution for that?

Thanks

[#4]

I have the same issue , did you find a solution

[#5]

Hi,

may you PM me some more details about how many devices are blocked by this and some more details. This would be helpful for MS.

best,

Oliver

[#6]

I have similiar case here. We have around 40 laptop users using O365 and devices are connected to Azure AD. Now I want to deploy M365 and Intune for them. I have upgraded users subscription to M365 and Windows version has been upgraded automatically to Windows 10 business as should. Computers won't pop-up automatically to Intune… I have read that I should cut the current connection to Azure AD from each Workstation and re-join devices again manually to Azure AD. I have tested this and computers will pop-up in Intune. This will do the trick, but isn't there a simpler way?

[#7]

At scale this would be so painful to do, I wonder if MS is working on this. I've had the same thoughts.

[#8]

Hi Guys,

Haven't had a chance to try this out in my lab, but it looks like enrolment can be triggered with Group Policy "starting Windows 10, version 1709 you can use a Group Policy to trigger auto-enrolment to MDM for Active Directory (AD) domain joined devices."

"When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. "

https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatica...

Hope this helps!

[#9]

The devices are already and only azure ad joined. As mentioned the solution seems to be leave azure ad and re-join, what is really impracticable for large deployments

[#10]

Ok... so to make sure I'm following your scenario 🙂

You have a large deployment of W10 machines in Workgroups (not joined to on-prem Active Directory), which have been Azure device joined (not Hybrid/ADDJ) and you want trigger Intune auto-enrolment?

[#11]

Precisely. The need to trigger auto enroll is because i will be heavily using the intune management extension (which is auto deployed only when auto enroll is used)

[#12]

Hi Jose,

Spent some time testing your scenario in my lab, and as suspected, you don't need to leave AAD and rejoin to trigger silent auto-enrolment 🙂

Please start another thread, tag me and we'll walk through my results.

Kind regards,

Matt

[#13]

Matt, could you please post your method here in this thread, since it's where the question was originally posted?

Thanks!

Bob

[#14]

Hi All,

Auto-Enrolment can be triggered using local policy. Please ensure users are logging into Windows using their Azure AD credentials, the device is Azure AD joined and users have been assigned Intune licenses.

Local policy can be configured using GPEdit.msc or applying the registry key below. Agreed this doesn't help in scenarios where you have roaming users, however the reg key could be deployed using PowerShell when users visit the Office.

** Tested using W10 - 1809

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM]
"AutoEnrollMDM"=dword:00000001

[#15]

Hey José,

currently the supported way is to re-join to trigger Intune Management Extension installation via auto-enroll. The only thing I can tell is the product group is aware of this. No information if it will change but they are aware.

best,

Oliver

[#16]

Thanks for the reply Oliver. I was just looking for an official confirmation that this is the only supported way. Its going to be tough tell that to our clients but it is what it is.

Thanks

[#17]

Yes that is the only way, had to do it for at least 50 laptops

[#18]

Hello, if its for Autopilot you can try that what Robin posted in his Blog:
https://www.robinhobo.com/automatic-add-existing-windows-10-devices-to-windows-autopilot/

[#19]

Hi Kaya,

thanks for your reply but that doest work because the devices are currently not managed by Intune 

"For this blog I have the following assumptions;

• You have Windows AutoPilot already up and running in your Azure tenant like described in my previous blog
• You have Windows 10 devices in use that are currently managed by Microsoft Intune but are not registered with Windows AutoPilot."

Imagine a following scenario, a company which is cloud only and all the devices (hundreds) are joined to Azure AD. They never seem the benefits of Intune before so the MDM was never configured. Now they are getting into the idea of managing these devices via Intune only and leverage the App Distribution provided by Intune (which requires Intune Management Extension). The only way the Management Extension is installed automatic is when the device is joined to Azure AD. So for this company be enabled with Intune and the Mgmt Extension they need to manually re-join all its devices to Azure AD.

That is Sadly the only way it currently works.

[#20]

I am running into this exact same scenario. The previous director of IT only enrolled in the office 365 plan with Azure Active Directory, and we now want to use MDM with InTune and its turning out that we can't because everyone is already signed into Azure Active Directory