Intune Enrollment with Azure Hybrid AD not funtioning.

Question

I am attempting to do some testing with Intune but so far have not even been able to get a single device to enroll properly.

I have followed the steps below to automatically enroll all Azure AD devices with Intune MDM but that does not seem to be happening.

https://learn.microsoft.com/en-us/microsoft-365/business/manage-windows-devices?view=o365-worldwide

The devices show up in Azure Active Directory admin center under Devices with a status of Hybrid Azure AD joined but the MDM status as None.

I cannot for the life of me figure out why it is not getting the MDM properly.

• MDM scope is set to All
• Users have Intune license applied
• The GPO has been setup for automatic MDM enrollment
• The device shows up under the user in Microsoft Endpoint Manager Admin center

What am I missing?

Answer 1

Please double confirm if the following requirements have met:

• AD-joined PC running Windows 10, version 1709 or later
• The enterprise has configured a mobile device management (MDM) service
• The enterprise AD must be registered with Azure Active Directory (Azure AD)
• The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with error 0x80180026)
• The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See How to plan your hybrid Azure Active Directory join implementation for more information.

Also, how about using group policy to enroll hybrid AD joined device? It is recommended by Intune. Here is the steps:
https://learn.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

If the methods still doesn’t help, investigate the log file if you have issues even after performing all the mandatory verification steps to see if there is any error message.
https://learn.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy#troubleshoot-auto-enrollment-of-devices

Answer 2

@Eric Elkmann I was recently engaged in an investigation around a similar scenario. If you confirm that the device is getting Hybrid AAD join and not just Intune enrolled, you need to start looking here first in order to track down, whats happening :

Check for these event logs :

Check for any Auto Enroll failure logs and share those.
Also share the output for dsregcmd /status from that machine.

If required we can take a look at that machine to figure out what is happening if the above two things dont help much. Let us know if you have any questions.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, do click on "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.