📱 Recipe · Intune & Device Management
Verify Intune Enrollment Status of a Windows Device and Trigger Manual Enrollment
Diagnose why a Windows device registered in Entra ID is not yet managed by Intune, and manually trigger MDM auto-enrollment without a full reimage or re-login
Complexity
Intermediate
Impact
Device Management + Intune + Windows + Troubleshooting + MDM Enrollment
Context
Why This Matters
After enabling automatic MDM enrollment in Entra ID (MDM user scope set to All or a specific group), Windows 10/11 devices that are Entra ID joined should enroll into Intune automatically. In practice, there's often a gap: the device shows as AzureAd joined in Entra ID but never appears in the Intune managed devices list.
Common causes include:
- The scheduled auto-enrollment task hasn't fired yet (can take up to an hour).
- The user is missing a valid Intune license (e.g., Microsoft 365 Business Premium, E3/E5, or standalone Intune).
- The device was joined before the MDM scope was set, so the enrollment trigger never ran.
- Group Policy or a conflicting MDM setting is blocking enrollment.
This recipe walks through how to verify a device's current enrollment state across Entra ID and Intune, then trigger manual enrollment on the device itself.
Expected Outcomes
After completing this recipe you will have:
- Confirmed whether the target device exists in Entra ID, in Intune, or both.
- Identified whether the user has an Intune license and whether the device is missing the MDM management agent.
- Triggered manual auto-enrollment on the device using the Windows Settings UI,
deviceenroller.exe, or a scheduled task re-run. - Verified the device is now reporting as managed in Intune with a valid compliance state.
Risks & Considerations
Warnings and gotchas
- Don't unjoin/rejoin as a first step. Disconnecting the work account from Windows can destroy local profiles and BitLocker recovery keys stored only in Entra ID. Always try manual sync first.
- License required. Auto-enrollment silently fails if the user has no Intune license. Check license assignment before troubleshooting the device.
- MDM vs MAM scope. Make sure the MDM user scope (not just MAM) is set to All or includes the user's group in Entra ID → Mobility (MDM and MAM).
- Hybrid join devices follow a different enrollment path via Group Policy or the "Enable automatic MDM enrollment using default Azure AD credentials" GPO —
deviceenroller.exealone may not be enough. - Propagation delay. After a successful enrollment, it can take 5–15 minutes for the device to show up in the Intune portal and Graph API.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Resolve the target user's account by display name or UPN |
| Device.Read.All | Read Entra ID device registration records to check join state and isManaged flag |
| DeviceManagementManagedDevices.Read.All | Query Intune to confirm whether the device has enrolled into MDM |
| Directory.Read.All | List a user's registeredDevices and ownedDevices in Entra ID |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Check whether {device_name} (owned by {user}) is managed by Intune. If it's registered in Entra ID but not enrolled in Intune, confirm the user has an Intune license, verify MDM auto-enrollment scope is set correctly, and provide step-by-step instructions to trigger manual enrollment on the device.
For End Users
How an employee would ask Dex for help
My work laptop isn't showing up as managed by IT even though I signed in with my work account. What do I need to do?
Step 1 — Verify the device in the Entra admin center
- Sign in to the (entra.microsoft.com).
- Navigate to .
- Search for the device by name (e.g.,
DESKTOP-PHSSKAD). - Note the Join type (Azure AD joined / Hybrid / Registered) and the MDM column. If MDM is blank, the device has not enrolled in Intune.
Step 2 — Verify in Intune
- Go to the (intune.microsoft.com).
- Navigate to .
- Search by device name. If no results, the device is not yet managed.
- Also check and confirm the MDM user scope is set to All or includes the user's group.
Step 3 — Confirm the user has an Intune license
- In the , open the user.
- Under Licenses and apps, verify a license that includes Intune is assigned (Microsoft 365 Business Premium, E3, E5, or Intune Plan 1/2).
Step 4 — On the user's device: trigger enrollment manually
- Have the user open .
- Click the connected work account, then click Info.
- Scroll to Device sync status and click Sync. This fires the MDM enrollment check.
- If nothing happens, open an elevated Command Prompt and run:
deviceenroller.exe /c /AutoEnrollMDM. - Alternatively, open Task Scheduler → Microsoft → Windows → EnterpriseMgmt and run the Schedule created by enrollment client for automatically enrolling in MDM from AAD task.
Step 5 — Verify enrollment succeeded
- Wait 5–15 minutes, then refresh .
- The device should now appear with a management agent of MDM and a compliance state.
1. Resolve the user
GET https://graph.microsoft.com/v1.0/users?$filter=startswith(displayName,'{name}')&$select=id,displayName,userPrincipalName2. Look up the Intune managed device
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices?$filter=deviceName eq '{deviceName}'&$select=id,deviceName,userPrincipalName,operatingSystem,complianceState,managementAgent,enrolledDateTimeIf the response value array is empty, the device is not enrolled in Intune.
3. Check the Entra ID device record
GET https://graph.microsoft.com/v1.0/devices?$filter=displayName eq '{deviceName}'&$select=id,displayName,isManaged,trustType,operatingSystemInterpret the response:
trustType: "AzureAd"+isManaged: true→ joined and should be/is managed by Intune.trustType: "AzureAd"+isManaged: nullorfalse→ joined but not enrolled in MDM. This is the state that requires manual enrollment.trustType: "ServerAd"→ hybrid joined; enrollment path is different.
4. List devices registered to the user
GET https://graph.microsoft.com/v1.0/users/{userId}/registeredDevices?$select=id,displayName,isManaged,trustType,operatingSystem5. (Optional) Check the user's Intune licenses
GET https://graph.microsoft.com/v1.0/users/{userId}/licenseDetailsExample: diagnosis response
{
"deviceName": "DESKTOP-PHSSKAD",
"entraId": { "trustType": "AzureAd", "isManaged": null },
"intune": { "enrolled": false },
"diagnosis": "Entra joined, not MDM enrolled — trigger auto-enrollment on device"
}Note: Graph cannot remotely trigger deviceenroller.exe on an unmanaged device. The enrollment trigger itself must run on the endpoint (steps in the Manual and PowerShell sections).
The PowerShell workflow has two halves:
- On the admin workstation — query Graph with Microsoft.Graph cmdlets to diagnose where the device is stuck.
- On the target device — run a local command to trigger enrollment.
Admin side: diagnose with Microsoft.Graph
Connect-MgGraph -Scopes "User.Read.All","Device.Read.All","DeviceManagementManagedDevices.Read.All"
# Look for the device in Intune
Get-MgBetaDeviceManagementManagedDevice -Filter "deviceName eq 'DESKTOP-PHSSKAD'"
# Look for the device in Entra ID
Get-MgDevice -Filter "displayName eq 'DESKTOP-PHSSKAD'" | Select-Object DisplayName, TrustType, IsManagedThe downloadable script below wraps these calls and produces a diagnosis report for any device name.
Device side: trigger enrollment
On the Windows device itself, the user (or helpdesk via remote session) runs one of:
# Option A — trigger the auto-enrollment task directly
deviceenroller.exe /c /AutoEnrollMDM
# Option B — run the scheduled task that Windows itself uses
Get-ScheduledTask -TaskPath "\Microsoft\Windows\EnterpriseMgmt\" | Start-ScheduledTaskNext steps