Issues with Device Enrollment in Intune

Question

Issues with Device Enrollment in Intune

Usman Abdullahi 0

We've configured a Group Policy to automatically enroll our devices in Intune. We have 9,000 Intune licenses and aim to onboard 8,000 devices. However, we're facing an issue where only 200 devices have been successfully enrolled so far.

To troubleshoot this, we've done a Dsreg cmd and the devices are hybrid joinde. we've also investigated the logs in Event Viewer on some of the affected devices and confirmed that the necessary discovery URLs are accessible on our network. Despite these efforts, the majority of our devices remain unenrolled.

We're seeking assistance to identify the root cause of this low enrollment rate and implement a solution to ensure the successful enrollment of the remaining devices.

0 comments

3 answers

Your answer

Answer 1

Crystal-MSFT 54,306 Microsoft External Staff

@Usman Abdullahi, Some more things we can do:

1, Run gpupdate /force or restart the device to update the group policy on the affected device.

2, Ensure the task scheduler in the following link is created

https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment#troubleshoot-the-auto-enrollment-task

3, When confirm Microsoft Entra Hybrid Join with dsregcmd command, make sure AzureAdJoined, DomainJoined and AzureadPrt are set to YES

4, Ensure all the network requirements are met.

https://learn.microsoft.com/en-us/mem/intune-service/fundamentals/intune-endpoints?tabs=north-america

Usman Abdullahi 0 Reputation points

2025-03-21T06:55:37.7633333+00:00
Thank you for your response and contribution.

All these has been done on some of the affected devices. what we observed was that on those devices, they were having similar error [ Auto MDM Enroll: Device credentials failed (0x0).

some of these devices, about 2k are Entra Hybrid

Others were Entra registered (about 4k), but they are all corporate devices.

We've searched for the error and tried to see how to fix it, but still the same, and it's not possible to keep checking individual devices as we would be looking at 6k plus devices.. DOing Manually would defeat the purpose of the auto enrollment
Crystal-MSFT 54,306 Reputation points Microsoft External Staff

2025-03-21T07:57:31.44+00:00

@Usman Abdullahi, Thanks for the reply. For GPO enrollment, the Microsoft Entra hybrid join is one of the requirements. Fo Microsoft Entra registered device, this is not supported to do GPO enrollment. We can firstly focus on these affected Microsoft Entra Hybrid Joined devices. As troubleshooting, we can just focus on one or two devices

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

For the error message, it seems the enrollment use device credential. For the devices which are user owned, we need to use user credential to enroll. Please confirm if we set User Credential in the GPO which apply to these affected devices.

Check the Actions on task scheduler to see which command it is used to do enrollment to avoid device credential is used in the command.
Usman Abdullahi 0 Reputation points

2025-03-21T08:26:51.45+00:00

Thank you for the quick and helpful response. I'll proceed with changing the GPO to use User credentials.

I need to inquire about our 4,000+ corporate devices that are Entra Registered devices. We have a Device registration GPO in place for over three months, and despite being domain-joined, these devices have not transitioned to Hybrid Entra Join. What are the necessary steps to force the conversion to Hybrid Entra Join?
Crystal-MSFT 54,306 Reputation points Microsoft External Staff

2025-03-21T08:37:14.7166667+00:00

@Usman Abdullahi, Currently we don' have any direct method to migrate from Microsoft Entra registered to Microosft Entra Hybrid joined. Only way along is to disconnect the devices from Entra ID and then plan your Microsoft Entra hybrid join implementation.

Answer 2

Reny Thomas 0

Hi Usman,

Please check if the MDM user scope is set to all or include the relevant users/groups:

Navigate to Azure AD > Mobility (MDM and MAM) > Microsoft Intune.
Confirm that MDM user scope is configured correctly.

Ensure MAM user scope is set to None, as it can conflict with MDM enrollment.

Please refer - https://learn.microsoft.com/en-us/mem/intune-service/enrollment/windows-enroll#enable-windows-automatic-enrollment

Hope it can help you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Usman Abdullahi 0 Reputation points

2025-03-11T05:41:21.45+00:00

Hi Reny, thank you for providing a response. The user scope is set to all, The group policy has been linked to all the computers and the the OUs have also been selected on Entra connect as well.

At first, for some of the onboarded devices, when we run the DSREG cmd, the discovery url wasn't populating, so we allowed the url on the firewall and a number of those devices could enroll.

Answer 3

Anonymous

@Usman Abdullahi Thanks for posting in our Q&A.

For this issue, we appreciate your help to collect some information:

1.Did these devices that not successfully enrolled to Intune show "Microsoft Entra hybrid joined" in Entra ID portal?

2.In addition, please refer to the following link to verify the configurations.

https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment

If there is anything update, feel free to let us know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Usman Abdullahi 0 Reputation points

2025-03-11T05:34:22.21+00:00
Thank you for your response.

Yes, the devices have been enrolled as Entra Hybrid joined. Just few about a thousand is still Entra Registered.

We've followed the teoubleshooting several times and those devices still wouldn't enroll into intune.
Anonymous

2025-03-12T02:24:00.89+00:00

@Usman Abdullahi Thanks for your update.

Based on my understanding, when you use Microsoft Entra Connect to sync something to Entra ID, it is also needed to sync some local AD users to Entra ID. Please check if some users' "on-premises sync enabled" shows "Yes" under Users in Microsoft Entra portal. If yes, please assign Intune license to these users and use these users to sign in devices to trigger enrollment.
Usman Abdullahi 0 Reputation points

2025-03-12T02:45:16.5333333+00:00

Thank you for taking time to respond to me.

All users are licensed for intune, both the synced users and the cloud created users. As at yesterday, only 4 devices have been added to the number of enrolled devices.

I think the enrollment is happening but 204 out of 6k is just too slow.
Anonymous

2025-03-12T05:51:24.5566667+00:00

@Usman Abdullahi It looks like the enrollment is successful, but it is too slow. There is no method to speed this process. Maybe it is needed to do log analysis to find the root cause. With Q&A limitation, Q&A is not a good channel for such issue. Given this situation, it is suggested to create an online support ticket to get more help. Here is the support link:

https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding and hope everything goes well with you.

Share via

Issues with Device Enrollment in Intune

3 answers

Your answer