Automatic Windows 10 PC Enrollment in Microsoft Intune or SCCM

The process of enrolling your Windows 10 computers in Intune should be as simple as possible for your users. If you’re using Azure Active Directory in your organization, the enrollment process can be made automatically when a user joins it’s device to AAD. It couldn’t be simpler. The process is the same rather for Intune Standalone or Hybrid mode (integrated with SCCM)

Windows 10 Intune Automatic Enrollment Prerequisites

• CNAME DNS Entry created on your domain for automatic name resolution
• A valid Intune Tenant (Standalone or SCCM Integrated)
• Azure Active Directory Premium enabled

For this post, we’ll be using a Windows 10 1703 device but the process is the same for Windows 10 1607 and slightly different for older versions but is supported.

CNAME DNS

Follow our Intune Preparation post for the steps to create CNAME entry.

The Azure portal let you test your configuration

• Open the Azure Portal
• Go to Intune / Device Enrollment / Windows Enrollment / CNAME Tester

• Enter your domain and click on Test
• Ensure that your test is successful

Verify Licences

We’ll start by verifying if our Intune and/or Azure Active Directory Premium License are enabled for this task.

• Open the Azure Portal
• Go to User and Groups / All Users
• Select your Global Administrator Account

• Select Licenses
• Select the product linked with your service (In our case EMS E5)

• Ensure that your Azure Active Directory Premium and Intune A Direct licenses are ON

Intune Configuration

We now need to enable Intune to accept automatic MDM enrollment requests.

• Go to Azure Active Directory
• Select Mobility (MDM and MAM) / Microsoft Intune

• In MDM User Scope, select All or Some
  • All : All Users are enabled to enroll devices
  • Some : Specify a group to limit device enrollment to this group only
• The 3 MDM link will be automatically filled. Do not change anything and click Save

We are now ready to automatically enroll a Windows 10 device in our Intune tenant.

Windows 10 Intune Automatic Device Enrollment

We will now test our enrollment procedure using a Windows 10 device.

• Open the Start menu
• Click on Settings

• Select Accounts / Access work or school / Connect

• Log in using an account in your domain and then select Next

• Enter your password

• If everything is set correctly, your device will be joined to Azure Active Directory and automatically enroll in Intune. Click Done

Verification

• Go back to Settings you’ll see that your account is enable

• You can click on the account and validate the enrollment by clicking on Info

• You can see your organization name at the top

If you followed the previous steps, but still fail to connect, see the Microsoft documentation or use the Export your management log file on the right. Consult the log file and refer to the MSDN documentation for the full error code list.

At this time you’ll see your device in the Intune Portal or in the SCCM console depending if you’re using Standalone or hybrid mode.

SCCM :

Intune :

Windows 10 Company Portal

The Company Portal app, lets you find and download available and required apps sent by your IT department. If you have the Company Portal app installed you can validate that the enrollment is successful.

If you don’t have the Company Portal installed :

• Select Start / Store
• Use Search, type company portal
• Select Company Portal / Install

• Open the Company Portal you’ll see that you’re automatically sign-in and that your device is automatically enrolled