Intune License for Device Enrollment Manager accounts

[DanielNguyen]

Hi all,

I am new to Intune and was assigned to a project to enroll all company Windows desktop to Intune. I would like to assign myself as a DEM and start the enrollment.

What I am not sure here is how the license will work? Microsoft stated that one DEM can enroll up 1,000 devices but the one Intune license only accommodate 15 devices as the limit. This causes the confusion.

Does anyone have experience with DEM or any advice in my case?

Thanks for anything that you can help.

Kind regards,

[#2]

A regular user can enroll 15 devices.
A DEM (with an Intune license) can enroll 1000.

If you would assign yourself the DEM role, then you can enroll 1000 devices. Either way, I would recommend that you don't assign the DEM role to your own account, but to an admin account. Otherwise, your regular account will have 1000 devices coupled with it.

What is your current environment? Are you devices AD joined/ AAD joined...? There might be a more automated solution for this

[#3]

Hi @Thijs Lecomte ,

Thanks for your information. 

The business has an AAD but not any AD, so I would say it requires only AzureAD-joined devices. Also, around 100 workstations already AAD-joined and it is looking for a Device Management solution so I would suggest Intune.

I found this information from Microsoft: If a device is used by more than one user, each requires a device software license or all users require a user software license. (URL: https://docs.microsoft.com/en-us/mem/intune/fundamentals/licenses-assign)

I tried to save cost by using user-based license as it can be used for up to 15 devices and to minimise the management, I would use a DEM to join all devices (I may misunderstand about the purpose of DEM). Everything seems ok except the licensing, e.g., with 1,000 joined devices, how the license will be allocated if we use user-based approach?

Any advice are more than welcome!

Cheers,

[#4]

DEM seems like the right solution then indeed.
For licensing (Let me start off by saying that I am no expert), but every user that uses a device that is managed by Intune, should also be licensed for Intune

[#5]

Thanks @Thijs Lecomte,

I will wait for more advice and also test how the license works. Will share here later on.

Cheers,

[#6 · Accepted solution]

@DanielNguyen 

Hi,

A good practice would be to create a dedicated user and assign an Intune license to this user. Then assign the Device Enrollment Role to it. This allows you to enroll up to 1000 devices.

If you have Azure AD Joined devices, they are already enrolled in Intune (Endpoint Manager). You maybe need to configure the proper settings first (Autoenrollment, DNS). But it requires Azure AD P1.

Also have a look at the device enrollment restriction policies. They do not apply to Device Enrollment Managers for Windows:

https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set#create-a-device-l...

Each user who is using Intune (Apps, Profiles, Policies, etc) needs a license.

If you have shared devices, Kiosk or Signage for example, you can use "Intune Device-only" licenses. This licenses do not need to be assigned to any device or user.

https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-intune-announces-de...

Hope this helps,

Cheers,

Al

[#7]

@alschneiter 

Thanks for the detail information you have shared.

I would bring up this scenario and hope you or anyone has time to help me out. 

Let's say I have two workstations to be shared by 5 other users, I will do the following step:

1. Assign one user as a DEM.
2. Assign him/her with "Microsoft Intune Device" License (2$/license/month). 
3. Purchase two more licenses for those two workstations and won't assign to any users or group of devices.

Questions:

1. Will the setting work?
2. Can the device considered as a shared device or extra configuration required?
3. Can Intune policy apply to other users when they login to those two workstations?

Thanks for anything that you can help.

Kind regards,

[#8]

Hi all,

I would share my experience with Intune Device License that as describe in this link (https://support.microsoft.com/en-au/help/4514392/introduction-to-device-licenses-in-microsoft-intune) I used DEM account to enroll the machine and it will automatically be assigned a device license but we need to manually monitor the number of licenses to make sure enrolled devices are fit within the purchased licenses.

I talked to Intune support team and they advised that Intune user-based profiles won't work on users who login these machine and it is correct. I tested with two users, one with valid user license and one without a license, all policies applied to the one with valid license but not the other one).

I will close this discussion but anyone has similar issues are welcome to contact me to discuss.

Kind regards,

[#9]

HI Thijis,

I enabled my admin account as a DEM account profile but still am getting error limit is exit , can you help me out this problem with your advise , once add it has any timeline to reflect ?

[#10]

@alschneiter does device need be logged in using the DEM account after the enrollment or can it the local admin stay logged in? I am testing a scenario where I am using DEM just for the enrollment and management of device, but not switch user. This is to accommodate for an already running kisosk based application on the device. However, my concern here is that this may break the update rings as the enrolling user will never log in on the device.