MDM User Scope is greyed out

Question

I can't change the MDM user scope even though I have the role of Intune Administrator. I've already double checked and the MDM authority is set to Intune. Do I not have sufficient privilege to change the MDM user scope? I thought Intune Administrator was sufficient enough. Any help at all would be greatly appreciated, thank you in advance.

I

Answer 1

Hello Martha Velazquez,

As mentioned by @Rahul Jindal, the Microsoft documentation confirms that changing the MDM user scope requires Global Administrator permissions. Refer to: https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-enroll#prerequisites

Hope this helps!

If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.

Answer 2

Changing the MDM user scope is not controlled by the Intune Administrator role itself but by tenant‑level configuration and licensing.

From the available information:

• An MDM authority must be set before MDM user scope can be used. This tenant already has MDM authority = Microsoft Intune, so that prerequisite is satisfied.
• Auto‑enrollment behavior is then controlled by the MDM user scope and MAM user scope settings. These determine which users can enroll devices and whether devices are MDM‑enrolled or only managed by MAM/Windows Information Protection.

When the MDM user scope controls are greyed out even for an Intune Administrator, it indicates that the tenant‑wide enrollment configuration is locked at the directory level rather than by Intune RBAC. In this state, only higher‑privileged directory roles (for example, those that can change Microsoft Entra auto‑enrollment and tenant‑wide device settings) can modify the MDM user scope.

To resolve the issue, have a directory admin with sufficient tenant permissions review and update the Windows automatic enrollment settings so that:

1. The correct users have a valid Intune license assigned.
2. The MDM user scope is set to All or Some (with the appropriate group) in the automatic enrollment configuration.
3. The MAM user scope is set appropriately (for example, None for education/corporate scenarios where full MDM enrollment is required).

Once a directory admin updates these tenant‑level enrollment settings, the MDM user scope options will no longer be greyed out for that configuration page, and Intune Administrator can then manage enrollment behavior through policy.

---

References:

• Set up Microsoft Intune
• Set up Microsoft Intune (windows)
• Diagnose MDM enrollment
• Troubleshooting Windows device enrollment errors in Intune
• Troubleshooting device enrollment in Intune
• Set the mobile device management authority