Switching Automatic Enrollment MDM User Scope from None to All

Question

Switching Automatic Enrollment MDM User Scope from None to All

Michael Anglen 0

Hi,

I'm trying to setup OOBE on some laptops for the first time and I have everything working except it won't let me change the MDM User Scope from 'None' to 'All'. Just to be clear, I can actually click on All, but the save button remains greyed out. I am a global admin with a business premium license which I thought would be enough, but it remains greyed out.

Any help on whether something else needs to be configured first or if I don't have a high enough license would be helpful.

Here is more info:

I've setup run the powershell script to get the machine hash, it shows in my Deployment Profiles and my devices list in Intune, but when I go to try and enroll it on the laptop (shift+Ctrl+f3 and choose pre-deployment) it fails in the first stage. I've narrowed that down to the fact that I can't change automatic enrollment settings. The save button stays greyed out.

Thank you,

Mike

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2026-06-04T16:24:01.77+00:00

Hello @Michael Anglen ,
This is a follow-up on the response above. If it helped answer your question, kindly mark it as Accepted Answer.

If you need more help, please share additional details in the comments.

Thanks!

1 answer

Your answer

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2026-06-04T16:24:01.77+00:00

Hello @Michael Anglen ,
This is a follow-up on the response above. If it helped answer your question, kindly mark it as Accepted Answer.

If you need more help, please share additional details in the comments.

Thanks!

Answer 1

The MDM user scope setting and the Save button are controlled by the Intune/MDM authority configuration and licensing. When the Save button is greyed out even though Global admin permissions are present, the usual causes are:

Intune/MDM authority not fully configured for the tenant.
Automatic MDM enrollment already controlled from the Microsoft Entra “Mobility (MDM and MAM)” blade instead of (or in addition to) the Intune admin center.
Enrollment restrictions or discovery URL configuration issues blocking changes.

Use the following checks and configuration path to resolve it.

Verify MDM authority and Mobility (MDM and MAM) configuration

In the Azure portal:

Go to Microsoft Entra ID → Mobility (MDM and MAM) → Microsoft Intune.
On the Configure page, set MDM user scope to Some or All, then Save.
Under Mobility (MDM and MAM), also select Microsoft Intune Enrollment and repeat step 2.

This ensures the tenant’s MDM authority and automatic enrollment are correctly configured for Intune and that the MDM user scope is actually set to All or Some at the directory level.

Confirm automatic enrollment configuration in Intune

In the Intune admin center:

Go to Devices → Enroll devices (or Windows Enrollment depending on portal layout) → Automatic Enrollment.
Ensure MDM user scope is set to Some or All and MAM user scope is set appropriately (typically None when managing the device itself).

From the documentation:

When MDM user scope is Some or All, devices that are joined to Microsoft Entra ID are managed by Intune.
When MDM user scope is None, devices are not joined to Microsoft Entra ID and are not managed by Intune.

Check for enrollment restrictions or discovery URL issues

If Cloud PCs or other Windows devices show messages like “ask your administrator to update policy settings” or “remove restrictions preventing Intune from allowing Windows enrollment,” then:

Review any enrollment restrictions configured in Intune that might prevent Windows enrollment.
Confirm that the MDM discovery URL is set to the default for Intune as described in the Windows 365 troubleshooting guidance.
Licensing considerations

Automatic MDM enrollment is a premium Microsoft Entra feature. If automatic enrollment settings are not available or not editable, ensure that:

The tenant has the required Microsoft Entra ID Premium capability (often surfaced as a prompt to start a trial when opening the Automatic Enrollment page).
The user accounts that will enroll devices have an Intune license assigned so that user-based policies can be applied.

Once MDM user scope is successfully set to All or Some and saved in the Mobility (MDM and MAM) configuration and in Intune’s Automatic Enrollment blade, OOBE/Autopilot enrollment should proceed past the first stage, and the pre-provisioning (white glove) flow should no longer fail due to automatic enrollment configuration.

References: