Managing multiple Windows computers can become challenging, especially when you need to configure security policies, deploy applications, manage updates, and keep company devices compliant. If you are handling several computers in an organization, manually enrolling each device in a Mobile Device Management (MDM) platform can take a lot of time.
Fortunately, automatic MDM enrollment in Windows makes this process much easier. It allows eligible Windows devices to automatically enroll in an organization’s MDM service, such as Microsoft Intune, when users sign in with their work or school accounts.
This feature is particularly useful for IT administrators who want to simplify device management, reduce manual configuration, and maintain consistent security settings across their organization.
In this guide, we will explain what MDM enrollment means, what you need before enabling it, and how to configure automatic MDM enrollment on Windows.
Understanding MDM Enrollment
Mobile Device Management (MDM) is a technology that allows organizations to manage computers, smartphones, and other devices from a centralized management platform.
For Windows computers, Microsoft Intune is a commonly used MDM solution. It helps IT administrators manage device configurations, enforce security policies, distribute applications, monitor compliance, and control access to organizational resources.
MDM enrollment is the process of registering a Windows device with an organization’s management service. Once enrollment is complete, the device can receive management instructions and policies from the administrator.
Automatic MDM enrollment takes this process a step further. Instead of asking users or administrators to manually enroll every computer, Windows can initiate enrollment automatically when the device meets the organization’s configured requirements.
For example, when an employee connects a Windows 11 computer to Microsoft Entra ID (formerly Azure Active Directory) using their work account, Windows can automatically enroll the device in Microsoft Intune.
It is important to understand that Microsoft Entra ID registration or joining and MDM enrollment are related but separate processes.
Joining a device to Entra ID does not automatically guarantee successful MDM enrollment.
The organization’s licensing, enrollment scope, and enrollment configuration must also be correct.
Enable Automatic MDM Enrollment for Windows [Complete Guide]
To enable automatic MDM enrollment for Windows, follow these steps:
- Make sure your organization has an eligible Microsoft Intune license.
- Configure the MDM user scope in the Microsoft Intune admin center.
- Open the Group Policy Management Editor on a supported Windows computer.
- Navigate to the automatic MDM enrollment policy.
- Enable the policy and select the appropriate credential type.
- Apply the Group Policy settings and update the device configuration.
- Connect the Windows device to Microsoft Entra ID.
- Verify that automatic MDM enrollment has completed successfully.
Before making changes, determine how your Windows devices are connected to your organization’s network. Automatic enrollment can work through Microsoft Entra ID, Microsoft Entra hybrid join, Windows Autopilot, and other supported provisioning scenarios.
The following steps cover the main Intune configuration and the Group Policy method commonly used for company-owned, domain-joined computers.
1: Check the Requirements for Automatic MDM Enrollment
First, make sure your organization meets the requirements for automatic MDM enrollment. You need an active Microsoft Intune subscription and an eligible Microsoft Entra ID P1 or P2 license for the automatic enrollment configuration.
You also need an administrator account with permission to manage enrollment settings in the Microsoft Intune admin center. The users whose devices will be enrolled must have the appropriate Intune licenses assigned to them.
For domain-joined computers, check whether your organization’s on-premises Active Directory environment is connected to Microsoft Entra ID. This is necessary when using the hybrid join and Group Policy enrollment method.
You should also confirm that the Windows devices are running a supported version of Windows 10 or Windows 11.
If another MDM service already manages a device, resolve that management conflict before attempting to enroll it in Intune.
2: Open the Microsoft Intune Admin Center
Now, you need to access the Microsoft Intune admin center to configure automatic enrollment.
Open your preferred browser and visit the Microsoft Intune admin center. Sign in using an administrator account that has the required permissions.
Once the dashboard opens, look for the device enrollment settings. Navigate through the following path:
Microsoft Intune admin center > Devices > Device onboarding > Enrollment > Windows > Automatic Enrollment
You should now see the Windows automatic enrollment configuration page.
This page contains the settings that determine which users can automatically enroll their Windows devices in Microsoft Intune.
If you cannot find the Automatic Enrollment option, check your Microsoft Entra licensing and administrator permissions. Automatic MDM enrollment requires an eligible Microsoft Entra ID Premium subscription.
3: Configure the MDM User Scope
This is one of the most important steps because the MDM user scope determines which Microsoft Entra users can automatically enroll their devices.
On the Automatic Enrollment page, locate the MDM user scope option. You will generally find three choices: None, Some, and All.
If you select None, automatic MDM enrollment remains disabled for all users. Users may still enroll their devices manually if your organization’s enrollment configuration permits it.
If you select Some, automatic enrollment is available only to users included in the selected group. This is a good option when you want to test the enrollment process with a small group before expanding it across your organization.
If you select All, automatic enrollment is enabled for all eligible users in your organization.
For most IT administrators, selecting Some is a sensible starting point because it allows you to test the configuration without immediately affecting every employee.
After selecting your preferred option, configure the required user or group selection and review the MDM enrollment settings.
Keep the default MDM discovery, terms of use, and compliance URLs unless your organization has a specific reason to change them.
Also, review the MAM or Windows Information Protection user scope. Avoid overlapping user assignments that could cause conflicts with the intended enrollment behavior.
Finally, select Save to apply your changes.
4: Configure Automatic MDM Enrollment Through Group Policy
If you manage Windows computers through an on-premises Active Directory environment, you can use Group Policy to trigger automatic MDM enrollment.
This method is particularly useful when you want to enroll several company computers without manually configuring each device.
On your Windows computer, press Windows + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor. If you manage multiple domain computers, use the Group Policy Management Console on your domain controller or an administrative computer.
Navigate through this path:
Computer Configuration > Policies > Administrative Templates > Windows Components > MDM
Look for the policy named Enable automatic MDM enrollment using default Microsoft Entra credentials.
Double-click the policy to open its configuration window. Select Enabled to activate automatic enrollment.
Next, locate the credential type dropdown menu.
For a standard user-associated Intune enrollment, select User Credential. This allows Windows to use the signed-in user’s Microsoft Entra credentials to initiate enrollment.
The Device Credential option is intended for specific supported scenarios, including certain co-management and Azure Virtual Desktop multi-session deployments. It is not a general replacement for user credentials.
After selecting the appropriate option, click Apply, followed by OK.
Your Group Policy configuration is now ready.
5: Apply the Group Policy Settings
After enabling the automatic enrollment policy, you need to make sure Windows receives the updated configuration.
If you are working with a local computer, open the Start menu, search for Command Prompt, and select Run as administrator.
Type the following command and press Enter:
gpupdate /force
Windows will refresh its Group Policy settings and apply the updated configuration.
If you are managing computers through a domain environment, make sure the appropriate Group Policy Object (GPO) is linked to the organizational unit containing the target computers.
You can also use a security group to control which computers receive the policy. This approach gives administrators better control over the enrollment process.
Once the policy refreshes, Windows creates a scheduled task that triggers automatic MDM enrollment. The task can run periodically for up to one day, so enrollment might not happen immediately.
Avoid repeatedly changing the policy if enrollment takes a few minutes. Give Windows enough time to complete the process.
6: Connect Your Windows Device to Microsoft Entra ID
Now, you need to make sure your Windows computer is connected to your organization’s Microsoft Entra ID environment.
Open Settings on your Windows 11 computer and navigate to:
Settings > Accounts > Access work or school > Connect
Select Connect and enter your organization’s work or school email address.
Follow the on-screen instructions to authenticate your account. Depending on your organization’s security requirements, you may also need to complete multifactor authentication.
For a company-owned computer that needs to join Microsoft Entra ID, select the appropriate option to join the device to the organization’s directory rather than simply adding a work account.
Once the connection is complete, Windows can use the configured enrollment settings to initiate MDM enrollment.
Remember that simply adding a work account does not guarantee that every device will automatically enroll. The user must be included in the configured MDM scope, and the device must meet the organization’s enrollment requirements.
7: Verify Automatic MDM Enrollment
After completing the previous steps, check whether your Windows computer has successfully enrolled in Microsoft Intune.
Open:
Settings > Accounts > Access work or school
Select your connected organizational account and click Info, if available.
You should be able to view information related to your organization’s device management connection and synchronization status.
You can also verify enrollment through the Microsoft Intune admin center.
Navigate to:
Devices > All devices
Search for your Windows computer using its device name. If enrollment is successful, the device should appear in the management console with its available device information.
For a more technical check, open Command Prompt and run:
dsregcmd /status
For a hybrid-joined computer, check that the output includes:
AzureAdJoined : YES
DomainJoined : YES
AzureAdPrt : YES
These values help confirm the device’s Microsoft Entra join and sign-in status. However, they do not independently prove successful MDM enrollment.
For additional confirmation, open Event Viewer and navigate to:
Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin
Look for Event ID 75, which indicates successful automatic MDM enrollment. Event ID 76 indicates an enrollment failure.
FAQs
1. What is automatic MDM enrollment in Windows?
Automatic MDM enrollment is a Windows feature that allows eligible computers to enroll in an organization’s Mobile Device Management service without requiring administrators to manually enroll each device. Microsoft Intune is one of the most commonly used platforms for this purpose.
2. Does Windows 11 support automatic MDM enrollment?
Yes. Windows 11 supports automatic MDM enrollment through Microsoft Entra ID, Group Policy, Windows Autopilot, and other supported enrollment methods. The exact requirements depend on the enrollment method you choose.
3. Do I need Microsoft Intune to enable automatic MDM enrollment?
If you want to use Microsoft Intune as your MDM provider, you need an eligible Intune subscription and the required Microsoft Entra ID licensing. Other MDM providers may have different licensing and configuration requirements.
4. Why is automatic MDM enrollment not working?
Automatic enrollment may fail because of an incorrect MDM user scope, missing licenses, unsupported Windows configurations, Group Policy problems, or existing device management connections. Check Event Viewer for enrollment errors and verify your Microsoft Entra ID settings.
5. How do I know whether my Windows device is enrolled in MDM?
Open Settings > Accounts > Access work or school, select your organizational account, and check the available management information. You can also open the Microsoft Intune admin center and look under Devices > All devices to confirm enrollment.
6. Can I enable automatic MDM enrollment for multiple computers?
Yes. IT administrators can use Group Policy Objects (GPOs) to configure automatic MDM enrollment for multiple Active Directory domain-joined computers. Security group filtering can help control which computers receive the enrollment policy.
7. Is automatic MDM enrollment safe?
Yes, when configured correctly by an organization’s IT administrators. However, users should understand that enrolling a personal computer in organizational MDM can allow the organization to apply device policies, manage certain settings, and access device management information.