MDM not getting register even for AD user

Question

i am try to enrolled the AD user system to intune by helpinh GPO but failed to register

all below check point are cleared from my side but system reqporting to entra admin portal but not showing intune

✅ Hybrid Entra Join working ✅ Device object exists in Entra (deviceId 5049b865...) ✅ AzureAdPrt : YES ✅ Intune license assigned ✅ MDM User Scope = All ✅ GPO applied (AutoEnrollMDM=1) ✅ Auto-enrollment task runs every 5 minutes ✅ Device gets as far as requesting an enrollment token

Answer 1

In your case the hybrid join and PRT are fine, but the missing piece is the actual MDM enrollment handshake. When the GPO triggers auto‑enrollment, the device requests a token from Entra, but Intune must accept and issue the enrollment profile. If the device shows in Entra but not Intune, it usually means the enrollment authority isn’t set correctly or the enrollment traffic is being blocked. Verify that Intune is set as the MDM authority in the Endpoint Manager admin center, and check the Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement‑Enterprise‑Diagnostics‑Provider for error codes like 0x80180018 or 0x8018002b. Those codes will tell you if the enrollment is failing due to policy, licensing, or connectivity. Also confirm that the device can reach enrollment.manage.microsoft.com without SSL inspection interfering. If all of that is correct, re‑apply the GPO and force a dsregcmd /status followed by mdmdiagnosticstool.exe -area Autopilot -cab c:\temp\mdm.cab to capture logs for deeper analysis.

Answer 2

Based on the checks already completed, focus on the remaining Intune/MDM-specific prerequisites and the known auto-enrollment failure patterns.

1. Confirm the device is not using the classic Intune PC agent

• Auto-enrollment via Group Policy does not work if the device is already enrolled with the classic Intune PC agent.
• On the affected device, remove any legacy Intune PC agent enrollment before relying on GPO-based MDM auto-enrollment.

2. Verify the MDM discovery URL and that the correct MDM provider is configured

• In Microsoft Entra admin center:
  • Go to Microsoft Entra ID → Mobility (MDM and MAM).
  • If both Microsoft Intune and Microsoft Intune Enrollment appear, ensure auto-enrollment is configured under Microsoft Intune, not Microsoft Intune Enrollment.
  • Confirm the MDM discovery URL is:
    • https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc.

3. Re-check MDM/MAM scopes and enrollment restrictions

• In Mobility (MDM and MAM) → Microsoft Intune:
  • Ensure MDM user scope is set to All (or Some including the affected users).
  • Ensure MAM user scope is set to None. If MAM is enabled for the same users, it can take precedence (especially for BYOD) and prevent MDM enrollment.
• In Intune:
  • Check Enrollment restrictions and confirm Enrollment of Windows devices is allowed.

4. Validate Microsoft Entra device settings

• In Microsoft Entra ID → Devices → Device settings:
  • Users may join devices to Microsoft Entra ID must be set to All.
  • Confirm the user has not exceeded the Maximum number of devices per user.

5. Check for the known auto-enrollment error 0x8018002b / Event ID 76

• On the device, open Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin.
  • Look for Event ID 75 ("Auto MDM Enroll: Succeeded"). If present, the device should appear in Intune shortly.
  • If enrollment fails, you typically see Event ID 76 with error 0x8018002b.
    • Common causes:
      • User UPN uses an unverified or non-routable domain (for example, user@contoso.local).
      • MDM user scope is None (already confirmed as All in this case, but still verify in the portal).
    • If UPN is non-routable:
      • In Active Directory Users and Computers (dsa.msc), change the user’s UPN suffix to a verified, routable domain (for example, contoso.com) on the Account tab.
      • For multiple users, select them in bulk and update the UPN suffix.
      • After changing UPNs, run a delta sync on the sync server:

                Import-Module ADSync
                Start-ADSyncSyncCycle -PolicyType Delta
        

6. Confirm all auto-enrollment prerequisites again on the device

• On the device, run dsregcmd /status and verify:
  • AzureAdJoined: YES
  • DomainJoined: YES
  • AzureAdPrt: YES
• Ensure the OS is a supported Windows version (Windows 10 1709 or later / supported Windows client version).
• Confirm the GPO is actually applied:
  • Computer Configuration → Policies → Administrative Templates → Windows Components → MDM → Enable automatic MDM enrollment using default Microsoft Entra credentials is set and visible via gpresult or Resultant Set of Policy.

7. If the enrollment task never logs 75 or 76

• If the scheduled task runs but neither Event ID 75 nor 76 appears:
  • Re-validate the GPO deployment and that the device is in the correct OU.
  • Confirm no conflicting policies or tools are blocking MDM enrollment.

Once these items are corrected (especially UPN routability, correct MDM provider, MAM scope = None, and no classic agent), the next run of the auto-enrollment scheduled task should complete and the device should appear in Intune.

---

References:

• Troubleshooting Windows 10 Group Policy-based auto-enrollment in Intune
• Troubleshooting Windows device enrollment errors in Intune
• Diagnose MDM enrollment
• Troubleshooting device enrollment in Intune