Choosing an enrollment method¶

How a device enrolls decides almost everything afterwards: whether it's corporate or personal, whether it's supervised, which settings you can apply, and how much the user has to do. Pick the method per platform and per scenario, and write the decision down.

Recommended methods at a glance¶

Decision flow¶

flowchart TD
    A[New device to manage] --> B{Who owns it?}
    B -->|Organization| C{Used by one person?}
    B -->|Employee| P{Do users accept<br/>device management?}
    C -->|Yes| D[Corporate single-user method:<br/>Autopilot, Apple ADE with user affinity,<br/>Android fully managed or COPE]
    C -->|No, shared or kiosk| E[Userless method:<br/>Autopilot self-deploying, ADE without affinity,<br/>Android dedicated]
    P -->|Yes| F[Personal enrollment:<br/>account-driven user enrollment,<br/>Android work profile]
    P -->|No| G[App protection only, no enrollment:<br/>MAM for iOS, Android, and Edge on Windows]

Before any enrollment¶

Whatever the platform, these must be in place first. The tenant setup checklist covers them in detail.

• Users have an Intune license (and Entra ID P1 for automatic Windows enrollment and Conditional Access).
• The platform's connection is set up: Apple MDM push certificate, ADE token, Managed Google Play.
• Enrollment restrictions allow the platform and ownership type.
• Compliance policies exist, so new devices don't sit in Not evaluated or count as compliant by default.
• Conditional Access doesn't block the enrollment itself. For example, a "require compliant device" policy must not apply to the Intune enrollment flow.

Concepts you'll meet in every enrollment guide¶

User affinity¶

A device with user affinity is tied to a user. It can run user-targeted policies, Company Portal, and user-based Conditional Access. A device without user affinity (kiosk, shared, self-deploying) can only use device-targeted assignments. Choose up front, because changing affinity usually means resetting the device.

Enrollment time grouping¶

Assigning policy to a dynamic device group has a built-in delay: the device has to enroll, then Entra ID has to evaluate the group rule, then Intune has to notice. Enrollment time grouping adds the device to a static security group during enrollment, so the first check-in already gets the right apps and policies. Autopilot device preparation uses it, and it's available for other enrollment profiles too.

Device enrollment managers¶

A device enrollment manager (DEM) is a special account that can enroll up to 1,000 devices. It's a legacy approach for bulk enrollment. DEM-enrolled devices have no real user, can't use user-based Conditional Access, aren't supported for Android corporate-owned work profile, and stay in Not evaluated for compliance. Use a modern userless method instead whenever the platform has one.

Monitor enrollment¶

Platform guides¶