Windows automatic MDM enrollment with Microsoft Entra join
Answer: Automatic Intune enrollment requires an in-scope user, an eligible Intune license, supported Windows edition, configured MDM user scope, and successful Microsoft Entra join or registration through a supported flow.
Administrator playbook
Decide, verify, and document
Use the curated answer as a starting point, then prove the outcome against the target tenant or device.
What it means
- MDM discovery uses tenant enrollment URLs
- Microsoft Entra ID P1 or P2 is required for some automatic enrollment options
- Registration and MDM enrollment are separate states
What to check next
- Verify MDM user scope and discovery URLs
- Confirm the user is licensed and below the device limit
- Inspect dsregcmd and DeviceManagement-Enterprise-Diagnostics-Provider logs
Verify success
- Confirm a new device record appears in the intended tenant and ownership state.
- Verify the device checks in, receives policy, and reports compliant or the expected transitional state.
- Capture a fresh successful enrollment timestamp and remove obsolete duplicate records.
Escalate when
- Multiple known-good users or devices fail at the same enrollment stage.
- The failure persists after scope, restriction, licensing, and stale-object checks.
- You can provide sanitized enrollment logs, UTC time, tenant, and correlation identifiers.
Copyable admin briefAnswer, next checks, source, and review date
Inspect join and registration state
dsregcmd /statusRead-only. Review Device State, Tenant Details, and SSO State; redact tenant and user identifiers before sharing.
Collect enrollment diagnostics
mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"Creates a local ZIP. Review and redact identifiers before sharing it.
Evidence to preserve
- Platform
- Windows
- Ownership
- Personal or corporate
- Reset
- Usually not required
- Identity
- Entra join or registration
- Platform, ownership, and OS version
- User license and MDM scope
- Enrollment restriction and device limit
- UTC failure time and enrollment error