Intune Auto Enrollment using group Policy

Question

Hello,

We are having issues onboarding a device to intune automatically using group policy. Additionally, Azure PRT is set to "No," as confirmed by the output of dsregcmd /status. The device is hybrid join.

Answer 1

Hello,

If your Hybrid Azure AD Join device is not auto-enrolling into Intune via Group Policy, follow these steps:

1. Verify Auto-Enrollment Policy:
   • Open Group Policy Management Editor → Navigate to: Computer`` Configuration > Policies > Administrative Templates > Windows Components > MDM
     • Enable "Enable automatic MDM enrollment using default Azure AD credentials" and set it to User Credential.
2. Check Azure AD PRT Status:
   • Run:

          
          dsregcmd /status
     

   • If AzureADPRT = No, verify that:
   • • The device is properly Hybrid Joined in Azure AD > Devices.
   • • Seamless SSO is enabled for AAD Connect.
   • • The device has internet access to Microsoft endpoints.
   • • The user is signing in with a Hybrid Azure AD Joined account.
3. Force Enrollment Sync & Reboot:
   • Run:

          gpupdate /force
     

     • Reboot the machine and check Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider for errors.

If the issue persists, ensure the Intune MDM enrollment settings allow auto-enrollment for Hybrid Joined devices under Azure AD > Mobility (MDM & MAM).

✨ Please Upvote and Accept the Answer if it helps! ✨

Thanks & Regards,

Tasadduq Burney

(Microsoft MVP & MCT)

(Azure 15x)

Answer 2

@Navida Iqbal, Thanks for posting in Q&A.

From your description, I know you are in trouble Auto Enrollment in Intune using GPO.

Based on my research, here is a link about troubleshooting Microsoft Hybrid Azure AD join you can refer to.

https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-hybrid-join-windows-current

https://www.manishbangia.com/troubleshoot-hybrid-azure-ad-join-issues/

Non-official, just for reference.

If the issue still persists, please un-enroll device from Intune and re-enroll.

https://www.maximerastello.com/manually-re-register-a-windows-10-or-windows-server-machine-in-hybrid-azure-ad-join/#:~:text=Manually%20re-register%20a%20Windows%2010%20%2F%20Windows%2011,the%20device%20as%20a%20Hybrid%20Azure%20AD%20Join

Non-official, just for reference.

Please try above information, if there is any update, feel free to let me know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.