Other Windows enrollment methods¶

Autopilot covers new devices. This page covers everything else: devices that already exist, devices managed by Configuration Manager, bulk enrollment without Autopilot, and the long road from hybrid join to Entra join.

Automatic enrollment (the foundation)¶

All Windows methods that join a device to Entra ID rely on automatic enrollment. When a user in the MDM user scope joins a device to Entra ID, the device enrolls in Intune at the same time.

1. In the Intune admin center, go to Devices > Enrollment > Windows > Automatic Enrollment. This opens the Entra Mobility (MDM and MAM) setting for Microsoft Intune.
2. Set MDM user scope to Some (with a pilot group) or All.
3. Leave the MDM terms of use, discovery and compliance URLs at their defaults.

Existing domain-joined devices: GPO enrollment¶

If your devices are already joined to Active Directory and hybrid joined to Entra ID, you can enroll them with Group Policy.

Requirements: Entra Connect (or Cloud Sync) syncing the computer objects, hybrid join working (dsregcmd /status shows AzureAdJoined : YES and DomainJoined : YES), users in the MDM user scope, and Entra ID P1.

1. Create or edit a GPO linked to the target OU.
2. Enable Computer Configuration > Policies > Administrative Templates > Windows Components > MDM > Enable automatic MDM enrollment using default Microsoft Entra credentials.
3. Choose User Credential for most physical devices. Device Credential is meant for scenarios where no user signs in to trigger enrollment, such as Azure Virtual Desktop and co-management.

How to check it worked:

• A scheduled task appears under Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt.
• Event ID 75 (success) or 76 (failure) is logged in Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
• The device appears in Intune as corporate-owned.

Co-management with Configuration Manager¶

Co-management lets Configuration Manager and Intune manage the same Windows device. You choose which service owns each workload, and you can move workloads one at a time with a pilot collection first.

Tips:

• Move each workload to Pilot Intune with a small collection before moving it to Intune for everyone.
• Use Group Policy analytics (Devices > Manage devices > Group Policy analytics) to see which of your GPO settings have Intune equivalents.
• Autopilot can enroll new devices straight into co-management (classic Autopilot only).
• Treat co-management as a bridge. The end state for most organizations is cloud-native Intune management.

Bulk enrollment with a provisioning package¶

For labs, classrooms or a stack of devices without Autopilot, a provisioning package can join devices to Entra ID and enroll them in Intune.

1. Install Windows Configuration Designer from the Microsoft Store.
2. Use the Provision desktop devices wizard. Under Account management, choose Enroll in Microsoft Entra ID and get a bulk token. Bulk tokens expire, with a maximum lifetime of 180 days.
3. Apply the package from a USB drive during setup, or by double-clicking it on a device that's already set up.

Devices enrolled this way are corporate-owned and have no primary user, so they suit shared devices. Delete the package when you're done: anyone holding it can join devices to your tenant until the token expires.

Personal Windows devices¶

For personal Windows PCs you usually don't want full device enrollment. Better options:

• App protection for Microsoft Edge (MAM for Windows): protects work data in the browser on unmanaged devices, with Conditional Access requiring app protection. See App protection.
• Windows 365 or Azure Virtual Desktop: give the user a managed Cloud PC and leave their own device alone.

If you do allow enrollment of personal devices (users select Settings > Accounts > Access work or school > Connect, or use Company Portal), the device is marked personal and you can only retire it, not wipe it.

Windows 365 and Azure Virtual Desktop¶

• Windows 365 Cloud PCs enroll in Intune automatically when they're provisioned. You manage them like physical devices, with the same policies and apps. Autopilot device preparation in automatic mode can install essential apps before the user first connects.
• Azure Virtual Desktop session hosts can be enrolled. Multi-session hosts support settings catalog policies (device settings assigned to device groups, user settings assigned to user groups), but not every policy type or remote action: wipe, Fresh Start and Autopilot reset, for example, aren't supported. Never enroll a cloned image of a machine that was already enrolled. Check supported features before you assign.

Windows settings backup and restore¶

Windows settings backup and restore (formerly Windows Backup for Organizations) lets users back up Windows settings and their Microsoft Store app list, then restore them on a new device during setup. It makes device refresh much less painful.

1. Turn on backup: create a settings catalog policy with Sync your settings > Enable Windows backup set to Enabled, and assign it to users or devices. Starting with Windows 11 version 26H2, backup is on by default for eligible devices unless your policy says otherwise.
2. Turn on restore: go to Devices > Enrollment > Windows > Windows Backup and Restore and set Show restore page to On. This is a tenant-wide setting and needs the Intune Administrator role.

Restore works only on Microsoft Entra joined devices during the out-of-box experience, including user-driven Autopilot. It doesn't work with hybrid join, self-deploying mode, the pre-provisioning technician phase, Autopilot reset, GPO or co-management enrollment, or shared devices.

Moving from hybrid join to Entra join¶

There's no supported in-place conversion from hybrid join to Entra join. The device has to be reset or reinstalled and then deployed as Entra joined. Plan it as part of your hardware refresh cycle.

1. Remove on-premises dependencies first. Typical blockers are GPO-only settings, on-premises file shares and printers, apps that need Kerberos to on-premises servers, and certificate-based Wi-Fi. Most have cloud equivalents:
   • Kerberos single sign-on to on-premises resources from Entra joined devices works with Windows Hello for Business cloud Kerberos trust and Microsoft Entra Kerberos. See Passwordless sign-in.
   • GPO settings move to the settings catalog. Use Group Policy analytics to find gaps.
   • Certificates come from Intune SCEP or PKCS profiles, or Cloud PKI.
2. Protect user data. Turn on OneDrive Known Folder Move and Windows settings backup before you reset anything.
3. Redeploy. Use a remote wipe followed by Autopilot (register the device first), or Autopilot for existing devices. New purchases arrive Entra joined from day one.
4. Clean up. Delete stale hybrid device objects and their Active Directory computer accounts.

Quick health checks on a Windows device¶

Learn more¶

• Enable Windows automatic enrollment
• Co-management overview
• Windows Backup for Organizations in Intune
• Microsoft Entra joined vs. hybrid joined in cloud-native endpoints