How do I manage Azure AD and local active directory domain users and devices?

Question

How do I manage Azure AD cloud users and devices, and local active directory domain users and devices in Microsoft Intune. We have synced the users to Azure AD but I am trying to get our on-premises devices enrolled. When I logged into the company portal, I used an admin account that is assigned as the device enrollment manager. This returned an error that I have attached.

Answer 1

@Dylan Howard, Thanks for posting in Q&A. From your description, it seems you want to enroll devices into Intune. But it is failed.

Before going on, I would like firstly to introduce the Intune enrollment methods. Different method is for different scenario. You can choose one suitable method for your scenario.

BYOD: Enroll their personally owned devices via company portal. Ownership: Personal.

DEM: It is a special service account have permissions that let authorized users enroll and manage multiple corporate-owned devices. These types of devices are good for point-of-sale or utility apps, for example, but not for users who need to access email or company resources.

Automatic enrollment via MDM: Joins the device with Microsoft Entra (Azure Active Directory) and enables users to sign in to Windows with their Azure AD credentials. If Auto Enrollment is enabled, the device is automatically enrolled in Intune.

Automatic enrollment via Group Policy: Configure Active Directory group policy to automatically enroll devices that are hybrid Azure AD joined. (Join on-premise domain, register to Azure AD device to enroll into Intune. Mainly for existing domain joined device.)

Windows Autopilot: Set up and pre-configure new devices, getting them ready for productive use.

Bulk enrollment: lets an authorized user join large numbers of new corporate-owned devices to Azure Active Directory and Intune. non-user affinity, can use device license.

Co-management: lets administrators enroll their existing Configuration Manager managed devices into Intune to get the dual benefits of Intune and Configuration Manager..

https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows

From your description, I notice you use DEM account to enroll. If this is a domain joined device, it is not suggested. You can choose GPO enrollment instead. To do GPO enrollment, the devices need to be Microsoft Entra Hybrid Joined firstly. Here are some links for your reference.

https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Looks like a DNS issue. If the devices are ADDS joined they may be pointing to local DNS servers without appropriate DNS forwarding. Ensure records such as enrollment.manage.microsoft.com can be resolved.

If you're not using automatic enrollment as part of your enrollment or provisioning solution, we recommend creating a domain name server (DNS) alias, called a CNAME record type, for your MDM servers. Instructions can be found at Enable auto-discovery of Intune enrollment server.

Let me know if you need additional or more detailed guidance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.