In this blog post, we will explore different methods for enrolling Windows 10 and Windows 11 devices into Intune. Microsoft Intune works with Entra ID to streamline the registration and enrollment process for personal and organization-owned Windows devices into Intune.
Once the device is joined or registered with the Entra ID tenant, you can use Intune to manage these devices. During the Intune device enrollment process, an MDM certificate is installed. This certificate is used to communicate with the Intune service and enforce compliance and other device configuration policies from the Intune admin center.
Enrollment of Devices into Intune is controlled by the Enrollment restrictions policy. You can control which devices can enroll in Intune by setting up device enrollment restrictions from Intune admin center.
Table of Contents
Types of Windows Devices Supported for Intune Enrollment
Using Intune, you can enroll the following two types of devices:
- Personally Owned – These devices are user’s personal devices in support of a Bring Your own Device (BYOD) scenario. You can enroll these types of devices into Intune.
- Corporate Owned – These types of devices are typically owned by your organization and support a scenario of end-to-end device management controls via Intune.
If you have not set up Intune MDM and MAM configuration to support Windows devices, you can refer to this step-by-step guide: “Initial Setup of Microsoft Intune MAM/MDM” To learn more about Intune reviews, pricing, and features, please refer to the link: “Microsoft Intune Reviews, Pricing, and Features“.
There are a few prerequisites for enrolling your Windows devices into Intune. Please find them below:
- Ensure that the Windows device is Supported for Intune Enrollment. Supported Windows Devices.
- An Intune License is assigned to the Users.
- MDM Authority is set to Intune or Intune + Configuration Manager.
Methods to Enroll Windows Devices into Intune
There are multiple methods to enroll Windows 10 and Windows 11 devices into Intune.
- Windows Automatic Enrollment
- Windows Autopilot
- BYOD: User Enrollment
- Co-management with Configuration Manager
Method 1 – Using Windows Automatic Enrollment
For Automatic Enrollment of your Windows 10 and Windows 11 devices, you will require Microsoft Entra ID P1 or Entra ID P2 license. Using this method you can enroll personal and corporate-owned devices.
Device Enrollment steps
Depending on the device type, a Windows device can be automatically enrolled in Intune by the end user using the following steps:
- Corporate Devices – These types of devices are typically owned by your company and when automatic enrollment is configured, User can go through the Out of Box Experience (OOBE) and enter their organizational credentials. This step will join the machine to Entra ID and enrollment in Intune happens automatically.
- BYOD/Personal Devices – For personal device types, users can log in to the device using personal account credentials, such as a Microsoft Account, and then follow the steps below to register the device in Entra ID.
- Open the Settings app > Accounts > Access work or school > Connect.
- Enter the Email Address and click on Next to proceed. This step will register your device into Entra ID as Personal. The device will be unmanaged.
Method 2 – Using Windows Autopilot
Windows Autopilot relies on automatic enrollment, and as a prerequisite also requires an Entra ID P1 or Entra ID P2 license. Utilizing the Autopilot Out of Box Experience (OOBE), the device is automatically enrolled in Intune based on the Autopilot Deployment/Enrollment Profile.
It’s important to note that Windows Autopilot can only be used for organization-owned devices and does not apply to personal or BYOD (Bring Your Own Device) types. To know more about Windows Autopilot and how to set it up, follow this link: Windows Autopilot Setup – A Comprehensive Guide.
- Create an Autopilot Deployment profile.
- Upload Device hardware hash in Intune.
Device Enrollment Steps
Based on the Autopilot Deployment profile, a device is automatically enrolled in Intune when a user authenticates with their organization-provided credentials during the Out of Box Experience (OOBE). There are three Autopilot deployment options:
- Self-Deploying mode – Enrollment starts automatically when a user turns on the device. It will automatically Join it to Entra ID and Enroll in Intune.
- Pre-provisioning – As the device is pre-provisioned, the Enrollment process kicks in when a user signs in to the device.
- User-driven – After a device is shipped to the user, They can Sign in to the device to start the Entra ID join and Intune Enrollment process automatically.
Method 3 – BYOD: User Enrollment
These steps apply to personal or BYOD-type devices that you wish to enroll in Intune. This type of device will show as Personal in Entra ID.
- Create a CNAME record in DNS (Optional but recommended).
Device Enrollment Steps
You can register your device with Entra ID as a personal device using the below steps.
- Go to Settings App > Accounts > Access school or work > Connect.
- Enter the Organization Provided Email Address in the text box and click on Next.
- This registers your device in Entra ID and displays it as ‘Personal‘. It’s important to note that the organization user is managed by Intune, not the device.
If your organization allows, you can also join a BYOD-type device to Entra ID by clicking on ‘Join this device to Entra ID‘. This ensures that the personal device is managed by Intune. If you don’t want to manage a Personal device by Intune, you can enter the email address and click on Next without clicking on “Join this device to Entra ID“.
If you are attempting to join a Windows device using Entra ID and encounter error code 80180014, it may indicate that the administrator has not permitted the enrollment of Personal/BYOD (Bring Your Own Device) types in Intune. To address this issue, please refer to the article titled “Fix for error code 80180014” for guidance.
Method 4 – Co-Management Enrollment
If you are using Configuration Manager and Intune together to manage Windows 10/11 devices, then you can use the Co-management enrollment method. Using this method, you run some services in the configuration manager and some services are running in Intune.
If Automatic Enrollment is enabled, users will sign in on the device and automatically enroll in Intune. However, users also have the option to manually go to Settings > Accounts > Access work or school > Connect and sign in with their organizational email address and password.