problem with Auto-Enrollment for windows devices in Hybrid enviroument
Hi everyone, I am in the process of setting up Intune for automatic enrollment on Windows devices within our hybrid environment. Here are the steps I have taken so far: 1. Configured Entra ID sync to synchronize a selected OU with Entra ID. 2. In the Intune Portal, set the Automatic enrollment MDM user scope to "All." 3. Created a GPO linked to that OU, which includes the settings to "register domain-joined computers as devices" and "Enabled automatic MDM enrollment using default Azure credentials" based on User Credential. 4. Prepared a clean computer, free of any software, and joined it to the Domain (on-prem server). 5. Moved the computer to the appropriate OU for syncing with Entra ID. 6. At this point, I can see the computer listed in the Entra ID portal under devices as Entra Hybrid joined 7. A regular domain user with a Business Premium license logged into the computer.( Only sign-in to windows, we don't have office app or add this account to windows.) 8. I ran GPupdate /force and rebooted the computer several times, but it still does not appear in the Intune portal. 9.Windows client is windows 11 Pro version 25H2 OS build 26200.8893 Dsregcmd output shows: ✅ Device is domain joined ✅ Device is synced to Entra ID ✅ Device authentication is working ✅ User has a valid PRT (Primary Refresh Token) ✅ Hybrid Join is successful On second test computer2, I installed office desktop app, then sign-in with test user to activate it. After few minutes the computer appeared on Intune portal. but on test computer 1 without user's interaction, it doesn't show up. would you be able to help me with this? Does it really need user to attach his/her account manually to "work or school account" or sing-in to any office desktop apps?Android enrolment stuck at installing apps
Hi, We are seeing some issues lately with device enrolment on Android with the wizard getting stuck at installing required apps, even with one app (Intune). I've seen a few posts at the start of the year where this issue also persisted which suggested it was a Google issue, which would seem true here as the issue occurs across multiple tenants. So far we've tried: Leaving the device for 2 hours to install apps Different Android enrolment profiles (Dedicated is primary method) Enrolling via Knox and QR methods Multiple devices Multiple Wi-Fi networks Multiple tenants (one being completely green-field) Removing all entries of the device in Intune and Entra ID before attempting re-enrolment Removed all apps from configuration, leaving just the Intune app as default Unassigned all enrolment restrictions Intune does create a device entry for the device despite not reaching the home screen, with configuration policies showing as successfully applied. Registering the device with Entra is more temperamental though. As mentioned, Dedicated enrolment is our primary method. We did see that a previously enrolled device did successfully enrol when using Fully Managed but this doesn't help us. A new device that had never been enrolled before did enrol successfully and quickly but have yet to it again. We are using Samsung devices running Android 14.
Controlling device enrollment
Hi everyone. I used to add Android device S/Ns as corporate identifiers and block personal devices from joining our Intune. This works pre Android 10 but not any more. What I want to do is not allow any user to enroll a mobile device unless IT specifically allow it, in the case of iOS we add the SN as a corporate identifier and this works great, same applied to Android <10. I have a workaround for now, however, does anyone know of a way to do this? I have a banned device group and this prevents devices becoming compliant, but I can not make this dynamic so when a user registers a device we get an enrolment notification, we the ban the device which is workable but clumsy. If anyone has any ideas , solutions or suggestions I would really appreciate your time on this. Thanks - Bob - Reno
