📱 Recipe · Intune & Device Management

Enable Automatic Intune MDM Enrollment for Entra-Joined Windows Devices

Configure the MDM user scope so Entra-joined devices automatically enroll in Microsoft Intune

Complexity

Intermediate

Impact

tenant-wide + device-management + enrollment + intune + entra-id

Context

Why This Matters

When Windows devices join Microsoft Entra ID, they are not automatically managed by Intune unless the tenant's Mobility (MDM and MAM) policy is configured with an MDM user scope of All or a specific group. Without this, users will see their devices listed as Entra-joined but the Manage action is greyed out, no compliance policies apply, and apps/configurations cannot be deployed.

This recipe configures the Microsoft Intune MDM policy so that every (or a scoped set of) user's Entra-joined device automatically enrolls into Intune at join time — enabling compliance, Conditional Access integration, and app delivery. It also provides working navigation paths for the modern Entra admin center, since the Mobility (MDM and MAM) blade has moved between portals over time.

Run this when:

Standing up a new tenant and preparing for device rollout.
Migrating off a third-party MDM or from unmanaged Entra-joined devices.
Troubleshooting why new Entra-joined PCs are not appearing in the Intune console.

Expected Outcomes

The Microsoft Intune MDM policy appliesTo value is set to all (or a named group).
New Entra-joined Windows devices auto-enroll into Intune during the join flow.
Existing Entra-joined devices enroll at the next user sign-in or workplace-join sync.
Devices become eligible for compliance policies, Conditional Access, and app assignment.
The Manage button in the Entra device blade becomes active for enrolled devices.

Risks & Considerations

Warnings

Licensing is mandatory. Users must hold a license that entitles Intune (Intune Plan 1, M365 E3/E5, M365 Business Premium, EMS E3/E5, etc.). Users without an Intune license will fail enrollment silently.
Scope = All affects every licensed user. For large or regulated tenants, pilot with a group first before flipping to all.
Existing third-party MDM conflict. If devices are already enrolled in another MDM (e.g., Workspace ONE, Jamf for Windows, Kandji), they will not silently re-enroll. Unenroll from the prior MDM first.
Hybrid Entra join nuance. For Hybrid-joined devices, you additionally need the Group Policy Enable automatic MDM enrollment using default Azure AD credentials and Intune configured for the correct credential type.
MAM vs MDM scope. Do not set MAM scope to all unless you intend to enroll personal/BYOD devices into app-protection; it can cause unexpected user prompts on corporate machines.

Compliance notes

Automatic enrollment brings personal data into Intune's inventory (device name, model, OS, compliance state). Update your privacy notice and enrollment Terms of Use URL accordingly.
Changes to mobility policies are recorded in the Entra audit log; retain for your standard audit window.

Required Permissions

Permission	Why It's Needed
Policy.Read.All	Read the current Mobility (MDM and MAM) policy configuration.
Policy.ReadWrite.MobilityManagement	Update the MDM/MAM user scope (appliesTo) on the Microsoft Intune mobility policy.
Directory.Read.All	Resolve group IDs when scoping enrollment to a specific group.
Organization.Read.All	Verify tenant licensing includes Intune entitlements before enabling enrollment.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Enable automatic Intune MDM enrollment for our tenant so all Entra-joined Windows devices auto-enroll. Set the Microsoft Intune mobility policy MDM user scope to {scope: All | GroupName}, leave MAM scope at None, and confirm the change by reading the policy back.

Try in Dex Pro

Enable MDM auto-enrollment via the Entra admin center

Prerequisites

Global Administrator or Intune Administrator role.
Users have an Intune-entitled license assigned.
Target devices are (or will be) Entra-joined or Hybrid Entra-joined.

Step 1 — Open the Mobility (MDM and MAM) blade

The blade has moved between portals. Use whichever of these paths appears in your tenant:

Microsoft Entra admin center (entra.microsoft.com) → Identity → Devices → Mobility (MDM and MAM)

If you don't see it there, try:

Entra admin center → Identity → Devices → Overview → Device settings → scroll to Mobility (MDM and MAM)

Or the legacy Azure portal path:

portal.azure.com → Microsoft Entra ID → Mobility (MDM and MAM)

You can also search for Mobility in the top search bar.

Step 2 — Select Microsoft Intune

In the list of MDM providers, click Microsoft Intune. If Microsoft Intune is not listed, the Intune subscription has not been activated — open the Intune admin center once at intune.microsoft.com to initialize it, then return here.

Step 3 — Set the MDM user scope

Under MDM user scope, choose:
- All — every licensed user's devices auto-enroll.
- Some — click Select groups and pick a pilot/rollout group.
Leave the URLs (MDM Terms of Use, Discovery, Compliance) at their defaults unless you have a specific customization.

Step 4 — (Optional) Configure MAM scope

Set MAM user scope to None for a pure MDM deployment. Only enable MAM if you intend to apply App Protection Policies to unmanaged/BYOD devices.

Step 5 — Save and verify

Click Save at the top of the blade.
On a test PC, join it to Entra ID via Settings → Accounts → Access work or school → Connect → Join this device to Azure AD.
After sign-in, go to Settings → Accounts → Access work or school, click the account, and confirm Info is available (indicates MDM enrollment succeeded).
In the Intune admin center, navigate to Devices → All devices and confirm the device appears with Managed by: Intune.

Enable MDM auto-enrollment via Microsoft Graph

The Mobility (MDM and MAM) policy is exposed on the beta endpoint as mobileDeviceManagementPolicies and mobileAppManagementPolicies. The well-known policy ID for Microsoft Intune is 0000000a-0000-0000-c000-000000000000.

Step 1 — Read the current MDM policy

GET https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies

Sample response:

{
  "value": [{
    "id": "0000000a-0000-0000-c000-000000000000",
    "displayName": "Microsoft Intune",
    "appliesTo": "none",
    "isValid": true,
    "discoveryUrl": "https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc",
    "complianceUrl": "https://portal.manage.microsoft.com/?portalAction=Compliance",
    "termsOfUseUrl": "https://portal.manage.microsoft.com/TermsofUse.aspx"
  }]
}

Step 2 — Set MDM scope to All

PATCH https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000
Content-Type: application/json

{
  "appliesTo": "all"
}

A successful call returns 204 No Content.

Step 3 — (Alternative) Scope to a specific group

To scope to a group, set appliesTo to selected and add group references via the includedGroups navigation property:

PATCH /beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000

{
  "appliesTo": "selected"
}

POST /beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000/includedGroups/$ref

{
  "@odata.id": "https://graph.microsoft.com/v1.0/groups/{group-id}"
}

Step 4 — Verify

GET /beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000

Confirm "appliesTo": "all" in the response.

Step 5 — (Optional) Mirror the setting for MAM

PATCH /beta/policies/mobileAppManagementPolicies/0000000a-0000-0000-c000-000000000000

{
  "appliesTo": "none"
}

Accepted values for appliesTo: none | all | selected.

Enable MDM auto-enrollment with Microsoft Graph PowerShell

This workflow uses the Microsoft.Graph PowerShell SDK to read and update the Intune mobility policy. The same Graph endpoint used above is called via Invoke-MgGraphRequest since there is no dedicated cmdlet for this policy.

Prerequisites

PowerShell 7+ recommended.
Microsoft Graph PowerShell SDK: Install-Module Microsoft.Graph -Scope CurrentUser.
Account with Intune Administrator or Global Administrator role.

Step 1 — Connect with required scopes

Connect-MgGraph -Scopes "Policy.Read.All","Policy.ReadWrite.MobilityManagement","Directory.Read.All"

Step 2 — Read the current Intune MDM policy

# Well-known policy ID for Microsoft Intune
$policyId = "0000000a-0000-0000-c000-000000000000"
$current = Invoke-MgGraphRequest -Method GET `
    -Uri "https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/$policyId"
$current | Format-List id, displayName, appliesTo, isValid

Step 3 — Set scope to All

$body = @{ appliesTo = "all" } | ConvertTo-Json
Invoke-MgGraphRequest -Method PATCH `
    -Uri "https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/$policyId" `
    -Body $body -ContentType "application/json"

Step 4 — Verify

(Invoke-MgGraphRequest -Method GET `
    -Uri "https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/$policyId").appliesTo
# Expect: all

Use the downloadable script below for a parameterized, error-handled version that supports scoping to All, None, or a specific group.

Next steps

More Intune & Device Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.