Enrollment Settings, Restrictions and Windows Automatic Enrollment

What it is

Enrollment is when a device becomes managed by Intune: Intune installs a management certificate, then enforces policies. Before devices enroll, you configure enrollment settings: which platforms and ownership types are allowed, how many devices a user may enroll, who may enroll in bulk, and which accounts are covered by automatic enrollment on Windows.

How it works

Enrollment restrictions

There are two types, found under Devices, Enrollment, Enrollment restrictions (or Enrollment options).

Every tenant has a default restriction, and you create additional ones with a priority. A restriction applies to the users or groups you assign, and the highest priority restriction (the lowest number) wins for each user. They apply at enrollment time only, so they do not unenroll devices that are already managed.

To block personal devices on Windows, use a platform restriction together with corporate identifiers (the serial number or IMEI of company devices) so that Intune can tell which devices are corporate owned. Devices not on the list are treated as personal. Enrollment restrictions are not available for Linux and some Windows enrollment scenarios.

Device enrollment managers

A device enrollment manager (DEM) is a non administrator Entra account that can enroll many corporate devices. A standard user can enroll only up to the limit set by the device limit restriction, but a DEM can enroll up to 1,000 devices. Devices enrolled by a DEM have no user affinity, and some methods, such as Apple automated device enrollment, are not compatible with DEM accounts.

Automatic enrollment for Windows

Automatic enrollment links Entra join or registration to Intune enrollment. In the Entra admin center, under Mobility (MDM and MAM), select Microsoft Intune and set:

• MDM user scope: None, Some or All. Users in scope have their Windows devices enrolled automatically when they join or register.
• MAM user scope: for app protection without enrollment.

If both scopes include the same user, the MAM scope takes precedence for personal registered devices, and the device is not enrolled for full MDM management. Automatic enrollment needs Entra ID P1 or P2.

Windows enrollment methods

For BYOD, the device is Entra registered and managed by Intune. When a device enrolls through Entra join, its ownership becomes corporate automatically.

Other enrollment features

• Terms and conditions that users must accept before enrolling.
• Conditional Access with MFA (Entra ID P1 or P2) can require a second factor during enrollment.
• Enrollment Status Page to show installation progress on Windows.
• Reports: Devices, Monitor, Enrollment failures lists failed attempts with reason, OS, user and method, and a report shows incomplete or abandoned enrollments.

A worked scenario

A company wants only corporate owned Windows laptops to enroll, and employees may enroll at most five devices of any kind. The admin creates a platform restriction that blocks personally owned Windows devices, uploads the serial numbers of company laptops as corporate identifiers, and a device limit restriction of five with a higher priority than the default. She sets the MDM user scope to All, so devices joined during OOBE enroll automatically. For a shipment of 600 devices, a DEM account enrolls them for kiosk use.