Enrollment guide: Enroll Windows client devices in Microsoft Intune

Prerequisites (Applicable to All Windows Enrollment Types) 

Step 1: Verify Licensing

Ensure users have one of the following licenses:

• Microsoft Intune Plan 1

• Microsoft 365 E3/E5

• Microsoft 365 Business Premium

• Enterprise Mobility + Security (EMS) E3/E5

Step 2: Verify MDM Authority

Navigate to:

Microsoft Intune admin center

• Tenant administration

• Tenant status

Verify:

• MDM authority = Microsoft Intune

Step 3: Configure Microsoft Entra Automatic Enrollment

Navigate to:

Microsoft Entra admin center

• Mobility (MDM and MAM)

• Microsoft Intune

1. Windows Automatic Enrollment & Group Policy Flow

Step 1: Configure Automatic Enrollment

Navigate: Microsoft Entra admin center → Mobility (MDM and MAM) → Microsoft Intune

↓

Configure:

• MDM User Scope: All (or Selected Groups)

• MAM User Scope: None (Unless using App Protection Policies for Windows)

Step 2: Configure Group Policy (Hybrid Joined Devices)

Navigate: Group Policy Management → Computer Configuration → Administrative Templates → Windows Components → MDM

↓

Action: Enable: Enable automatic MDM enrollment using default Azure AD credentials

↓

Choose Credential Type:

• Device Credential (Recommended for Windows 10 1903+ and Windows 11)

• User Credential

Step 3: Synchronize Devices (Client-Side Action)

Navigate on Client PC: Settings → Accounts → Access work or school

↓

Action: Click: Info → Click: Sync

Step 4: Verify Enrollment Status

Navigate: Intune Admin Center → Devices → Windows

↓

Verify Device Displays:

• Managed by: Intune

• Compliance: Compliant (after policy evaluation)

2. Windows Autopilot 

Windows Autopilot Step-by-Step Deployment Flow

Step 1: Register Hardware Identities

Choose one of the following methods to register your device hardware hashes:

• Option 1 (Preferred / Automated): The OEM or hardware distributor uploads the hardware hash directly to your Microsoft Entra tenant at the time of purchase.

• Option 2 (Manual / PowerShell): Run the following commands on a target device to extract the hardware hash locally:

PowerShell

Install-Script -Name Get-WindowsAutopilotInfo -Force

Get-WindowsAutopilotInfo.ps1 -OutputFile AutoPilot.csv

Step 2: Import Devices to Intune

Navigate:

Devices → Windows → Windows enrollment → Devices → Import

↓

Action:

Upload the generated AutoPilot.csv file.

↓

Verification:

Monitor the device list until the Profile Status changes to Assigned.

Step 3: Create Deployment Profile

Navigate:

Devices → Windows → Windows enrollment → Deployment Profiles

↓

Action:

Click Create profile → Name it (e.g., Corporate Laptop Profile).

Step 4: Configure Profile Settings

Apply the following recommended configuration options within your profile:

Setting Recommended Value

Join Type Microsoft Entra Joined

User Account Type Standard User

Skip Privacy Settings Yes

Skip Cortana Yes

Skip OneDrive Optional

Skip OEM Registration Yes

Automatically Configure Keyboard Yes

↓

Action:

Assign this deployment profile to your target Autopilot device group.

Step 5: Dynamic Group Assignment

Action:

Create a dynamic Microsoft Entra ID group utilizing the Autopilot device attributes:

        ↓

Targeting:

Assign the following core resources directly to this dynamic group:

• Deployment Profile (Created in Step 3)

• Configuration Profiles (Wi-Fi, certificates, VPN)

• Compliance Policies

• Required Applications (Microsoft 365 Apps, security agents)

Step 6: End-User Out-of-Box Experience (OOBE)

User turns on the unboxed device

        ↓

Connects to a local Wi-Fi or cellular network

        ↓

Enters organizational Microsoft Entra ID credentials

        ↓

Autopilot automatically downloads and applies:

• Enrollment Profile  

• Applications  

• Configuration Profiles  

• Compliance Policies

        ↓

Device reaches the Windows desktop, secured and ready for use.

3. BYOD (User Enrollment) 

Windows BYOD Step-by-Step Enrollment Flow

Step 1: Enable BYOD Enrollment (Admin Action)

Navigate:

Devices → Enrollment → Enrollment restrictions

        ↓

Action:

Edit your platform restrictions profile and set Windows (MDM) for Personally owned devices to Allow.

Step 2: Initiate User Enrollment (Client-Side Action)

Navigate on Personal PC:

Settings → Accounts → Access work or school

        ↓

Action:

Click the Connect button.

Step 3: Identity & Authentication

Action:

The user enters their corporate organizational credentials (Microsoft Entra ID account) when prompted by the login wizard, followed by any required Multi-Factor Authentication (MFA) challenges.

Step 4: Grant Management Permissions

Action:

During the sign-in handshake, the user must ensure the following option remains checked:

☑ Allow my organization to manage my device

        ↓

Status:

Clicking OK/Next triggers the silent MDM auto-enrollment registration, anchoring the personal device certificate into Microsoft Intune.

Step 5: Verify Successful Enrollment

Navigate on Client PC:

Settings →  Accounts →  Access work or school

        ↓

Verify Text/Icons Displayed:

• Connected to [Organization Name] Microsoft Entra ID

• Click Info to verify it states: Managed by Microsoft Intune

4. Co-management with Configuration Manager 

Co-management with Configuration Manager Step-by-Step Deployment Flow 

Prerequisites

Ensure the environment meets the following baseline requirements before initiating co-management:

• Supported version of Configuration Manager Current Branch

• Active Microsoft Intune tenant

• Active Microsoft Entra tenant

• Cloud Attach enabled

• Managed endpoints running a supported version of Windows 10 or Windows 11

Step 1: Configure Cloud Attach

Navigate:

Administration → Cloud Services → Cloud Attach in the Configuration Manager console.

        ↓

Action:

Run the Cloud Attach wizard to configure:

• Tenant attach: Integrates the on-premises site with the cloud service.

• Device upload: Specifies which device collections upload to the cloud console.

• Targeting: Select targeted device collections for synchronization.

Step 2: Enable Co-management

Navigate:

Administration → Cloud Services → Co-management

        ↓

Action:

Launch the Co-management Configuration Wizard and input the required infrastructure properties:

• Microsoft Entra tenant credentials

• Microsoft Intune subscription details

• Cloud enrollment restrictions and settings

Step 3: Configure Automatic Enrollment

Action:

Configure the system to trigger silent, automatic MDM enrollment once devices are cloud-attached.

        ↓

Set Enrollment Scope:

• Pilot: Automatically enrolls only the devices contained within a designated Configuration Manager pilot collection.

• All: Automatically enrolls all supported Windows devices managed by the hierarchy.

Step 4: Configure Workload Transitions

When moving management authority from Configuration Manager (on-premises) to Microsoft Intune (cloud), utilize a phased approach by shifting the sliders (dials) gradually.

Step 5: Verify Co-management Status

On-Premises Verification (Configuration Manager console)

Navigate: Assets and Compliance →  Devices

• Confirm the targeted device column displays: Co-management = Yes

Cloud Verification (Intune Admin Center)

Navigate: Devices →  Windows

• Verify the endpoint object appears in the inventory and successfully checks in to receive cloud policies.