Set up enrollment for Windows devices

Applies to

  • Windows 10
  • Windows 11

This article helps IT administrators simplify Windows enrollment for their users. Once you've set up Intune, users enroll Windows devices by signing in with their work or school account.

As an Intune admin, you can simplify enrollment in the following ways:

Two factors determine how you can simplify Windows device enrollment:

  • Do you use Azure Active Directory Premium? Azure AD Premium is included with Enterprise Mobility + Security and other licensing plans.
  • What versions of Windows clients will users enroll? Devices running Windows 11 or Windows 10 can automatically enroll by adding a work or school account. Devices running earlier versions must enroll using the Company Portal app.
Azure AD Premium Other AD
Windows 10/11 Automatic enrollment User enrollment
Earlier Windows versions User enrollment User enrollment

Organizations that can use automatic enrollment can also configure bulk enroll devices by using the Windows Configuration Designer app.

Device enrollment prerequisites

Before an administrator can enroll devices to Intune for management, licenses should have already been assigned to the administrator's account. Read about assigning licenses for device enrollment.

You can also let unlicensed admins sign in to MEM. For more information, see Unlicensed admins.

Multi-user support

Intune supports multiple users on devices that both:

  • Run Windows 11 or the Windows 10 Creator's update
  • Are Azure Active Directory domain-joined

When standard users sign in with their Azure AD credentials, they receive apps and policies assigned to their user name. Only the device's Primary user can use the Company Portal for self-service scenarios like installing apps and device actions (like Remove or Reset). For shared Windows 10/11 devices that don't have a primary user assigned, the Company Portal can still be used to install Available apps.

Enable Windows automatic enrollment

Automatic enrollment lets users enroll their Windows devices in Intune. To enroll, users add their work account to their personally owned devices or join corporate-owned devices to Azure Active Directory. In the background, the device registers and joins Azure Active Directory. Once registered, the device is managed with Intune.


  • Azure Active Directory Premium subscription (trial subscription)
  • Microsoft Intune subscription
  • Global Administrator permissions

Configure automatic MDM enrollment

  1. Sign in to the Azure portal, and select Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune.

    Screenshot shows the Azure portal selections.

  2. Configure MDM User scope. Specify which users' devices should be managed by Microsoft Intune. These Windows 10 devices can automatically enroll for management with Microsoft Intune.

    • None - MDM automatic enrollment disabled

    • Some - Select the Groups that can automatically enroll their Windows 10 devices

    • All - All users can automatically enroll their Windows 10 devices


      For Windows BYOD devices, the MAM user scope takes precedence if both the MAM user scope and the MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will not be MDM enrolled, and Windows Information Protection (WIP) Policies will be applied if you have configured them.

      If your intent is to enable automatic enrollment for Windows BYOD devices to an MDM: configure the MDM user scope to All (or Some, and specify a group) and configure the MAM user scope to None (or Some, and specify a group – ensuring that users are not members of a group targeted by both MDM and MAM user scopes).

      For corporate devices, the MDM user scope takes precedence if both MDM and MAM user scopes are enabled. The device will get automatically enrolled in the configured MDM.


    MDM user scope must be set to an Azure AD group that contains user objects.

    Screenshot shows the Azure portal, where you can configure M D M User scope.

  3. Use the default values for the following URLs:

    • MDM Terms of use URL
    • MDM Discovery URL
    • MDM Compliance URL
  4. Select Save.

By default, two-factor authentication is not enabled for the service. However, two-factor authentication is recommended when registering a device. To enable two-factor authentication, configure a two-factor authentication provider in Azure AD and configure your user accounts for multi-factor authentication. For more information, see Getting started with the Azure Active Directory Multi-Factor Authentication Server.

Simplify Windows enrollment without Azure AD Premium

To simplify enrollment, create a domain name server (DNS) alias (CNAME record type) that redirects enrollment requests to Intune servers. Otherwise, users trying to connect to Intune must enter the Intune server name during enrollment.

Step 1: Create CNAME (optional)

Create CNAME DNS resource records for your company's domain. For example, if your company's website is, you would create a CNAME in DNS that redirects to

Although creating CNAME DNS entries is optional, CNAME records make enrollment easier for users. If no enrollment CNAME record is found, users are prompted to manually enter the MDM server name,

Type Host name Points to TTL
CNAME 1 hour
CNAME 1 hour

If the company uses more than one UPN suffix, you need to create one CNAME for each domain name and point each one to For example, users at Contoso use the following formats as their email/UPN:


The Contoso DNS admin should create the following CNAMEs:

Type Host name Points to TTL
CNAME 1 hour
CNAME 1 hour
CNAME 1 hour – Supports a redirect to the Intune service with domain recognition from the email's domain name

Changes to DNS records might take up to 72 hours to propagate. You can't verify the DNS change in Intune until the DNS record propagates.

Step 2: Verify CNAME (optional)

  1. In the Microsoft Endpoint Manager admin center, choose Devices > Windows > Windows enrollment > CNAME Validation.
  2. In the Domain box, enter the company website and then choose Test.

Additional endpoints that aren't supported is the preferred FQDN for enrollment. There are two other endpoints that have been used previously and still work. However, they're no longer supported. (without the -s) and both work as the target for the auto-discovery server, but the user will have to touch OK on a confirmation message. If you point to, the user won't have to do another confirmation step, so this is the recommended configuration

Alternate methods of redirection aren't supported

Using a method other than the CNAME configuration isn't supported. For example, using a proxy server to redirect to either or isn't supported.

Tell users how to enroll Windows devices

The Microsoft Intune user-help docs provide conceptual information, tutorials, and how-to guides for employees and students setting up their devices. You can point people directly to them or use these articles as guidance when developing and updating your org's own device management docs.

These articles describe how to enroll devices running Windows:

For information about how enrollment affects the device and the information on it, see What information can my organization see when I enroll my device?


End users must access the Company Portal website through Microsoft Edge to view Windows apps that you've assigned for specific versions of Windows. Other browsers, including Google Chrome, Mozilla Firefox, and Internet Explorer do not support this type of filtering.


If you do not have Auto-MDM enrollment enabled, but you have Windows 10/11 devices that have been joined to Azure AD, two records will be visible in the Intune console after enrollment. You can stop this by making sure that users with Azure AD joined devices go to Accounts > Access work or school and Connect using the same account.

Registration and Enrollment CNAMEs

Azure Active Directory has a different CNAME that it uses for device registration for iOS/iPadOS, Android, and Windows devices. Intune conditional access requires devices to be registered, also called "workplace joined". If you plan to use conditional access, you should also configure the EnterpriseRegistration CNAME for each company name you have.

Type Host name Points to TTL
CNAME 1 hour

For more information about device registration, see Manage device identities using the Azure portal

Windows auto enrollment and device registration

This section applies to US government cloud customers on devices running Windows 10 or Windows 11.

Although creating CNAME DNS entries is optional, CNAME records make enrollment easier for users. If no enrollment CNAME record is found, users are prompted to manually enter the MDM server name,

Type Host name Points to TTL
CNAME 1 hour
CNAME 1 hour

Next steps