How to Enrol a Windows Device into Microsoft Intune

Introduction

When an organisation gives an employee a Windows laptop, the device needs to be connected to the organisation before IT can manage it. Two Microsoft services handle this together:

• Microsoft Entra ID manages the user’s identity and the device’s connection to the organisation.
• Microsoft Intune manages the device itself, including its settings, applications, security policies and compliance.

This post walks through how a Windows device is joined to Microsoft Entra ID and then enrolled into Intune automatically. The overall flow looks like this:

Windows Device → Microsoft Entra Join → Automatic Enrollment → Microsoft Intune

This walkthrough is based on a practical test in a small learning environment using a Windows virtual machine. It covers the basic enrollment process.

1. Setting Up the Microsoft Environment

Before you can enrol a device, you need an environment to enrol it into. For this test, that meant a Microsoft Entra tenant, Intune, and a test user with the right licences.

1.1 Create a Microsoft Entra Tenant

A tenant is the organisation’s own space in Microsoft, where its users and devices are managed. Everything in this guide happens inside it. The image below shows the Microsoft Entra tenant overview.

1.2 Set Up Microsoft Intune

Intune needs to be available in the tenant, either through an eligible licence or a trial. We used a Microsoft Intune Plan 1 trial. The image below shows the available Intune and Entra ID licences.

1.3 Create a Test User

Next, create a user in Microsoft Entra ID and assign the licences. Our test user was given:

• Microsoft Intune Plan 1
• Microsoft Entra ID P2

This is the account that signs in to the Windows device during enrollment. The image below shows the test user with the required licences

2. Essential Prerequisites

Two settings need to be in place before the device is set up. One allows users to join devices to Microsoft Entra ID, and the other allows Intune to enrol those devices automatically.

2.1 Allow Users to Join Microsoft Entra ID

In the Microsoft Entra admin center, go to:

Devices → Device settings

Find Users may join devices to Microsoft Entra ID. For this test environment, All is selected. The image below shows the available Intune and Entra ID licences.

When a Windows device joins the organisation’s Microsoft Entra ID, this is called an Entra join. After the join, the user can sign in to the device with their work account.

2.2 Configure Automatic Enrollment

In the Microsoft Intune admin center, go to:

Devices → Enrollment → Windows → Automatic Enrollment

Then set the following:

• MDM user scope: set to All. This decides which users can have their Windows devices enrolled into Intune automatically.
• WIP user scope: left as None, because Windows Information Protection was not needed for this test.
  
  

The image below shows Automatic Enrollment with MDM user scope set to All.

2.3 Prepare a Windows Device

Enrollment can be done on a physical Windows computer or on a virtual machine. For this practical test, we used Hyper-V to create a Windows virtual machine, so the enrollment could be tested separately from the main Windows installation.

For the practical test, we created a Windows 11 Pro virtual machine using Hyper-V and a Windows 11 ISO.

Both Microsoft Entra Join and Intune enrollment work with Windows 10 and Windows 11, but they require the Pro, Enterprise, or Education editions. We used Windows 11 Pro for this exercise because the Home version does not support these features.

The setup was completed as follows:

1. Create a Windows 11 virtual machine in Hyper-V.
2. Attach the Windows 11 ISO and use the Windows 11 Pro edition.
3. Start the VM and go through the Windows Out-of-Box Experience (OOBE).
4. Select Set up for work or school during Windows setup.
5. Sign in with the organisation account to join Microsoft Entra ID and start automatic Intune enrollment.

The same process can also be completed on a physical Windows 11 Pro device. In that case, the Hyper-V and ISO steps are not required.

Quick Checklist

• A Microsoft Entra tenant with Intune available
• A test user with the required licences
• Device join enabled in Microsoft Entra ID
• Automatic enrollment configured in Intune
• A Windows 11 Pro device or virtual machine with internet access

3. Enrolling the Windows Device

3.1 Start Windows Setup

For a new or reset Windows device, the setup starts with OOBE (Out-of-Box Experience). This is the first Windows setup screen that appears when Windows is installed or the device is reset.

The image below shows the Windows device at the initial OOBE setup stage.

During OOBE, select “Set up for work or school” and sign in with your organisation account.

The image below shows the OOBE option to set up the device for work or school.

3.2 Sign In with the Work Account

Enter the work account created in the Microsoft Entra tenant, for example:

testuser1@company.com

Then enter the password and complete MFA if it is required. This account identifies the user and connects the device to the organisation.

3.3 Microsoft Entra Join and Automatic Enrollment

After you sign in, Windows joins the device to Microsoft Entra ID. Because the MDM user scope was configured earlier, automatic enrollment then starts for any user who is in scope.

3.4 Complete Windows Setup

Let Windows finish the setup. When the desktop appears, go to:

Settings → Accounts → Access work or school

The work account should be listed as connected.

4. Verify the Enrollment

The device should now appear in both admin centers. It is worth checking each one separately, because joining Microsoft Entra ID and enrolling into Intune are two different steps.

4.1 Check the Device in Microsoft Entra ID

In the Microsoft Entra admin center, go to:

Devices → All devices

Find the Windows device in the list and check the following:

• Join type: Microsoft Entra joined
• MDM: Microsoft Intune
  
  The image below shows the device joined to Entra ID and managed by Intune.

4.2 Check the Device in Intune

In the Microsoft Intune admin center, go to:

Devices → Windows → Windows devices

The image below shows the device has been enrolled in intune.

Quick Verification

• The device is listed in Entra ID as Microsoft Entra joined
• Intune is shown as the MDM
• The same device is listed in Intune

5. How Automatic Enrollment Fits In

The Entra join connects the device to the organisation. Automatic enrollment is what lets Intune start managing it, as long as the user falls within the MDM user scope. From that point, Intune applies the policies, applications, security settings and compliance rules the organisation has configured.

The scope setting changes the result:

• All: every user can have their devices enrolled automatically.
• Some: only users in the selected groups are enrolled automatically.
• None: automatic enrollment does not happen, even though the device can still join Microsoft Entra ID.

Conclusion

This exercise made the relationship between Microsoft Entra ID and Intune much clearer. Entra ID connects the device to the organisation, and Intune takes over its management once automatic enrollment is in place. Both need to be configured before a device is set up, otherwise the device may join Microsoft Entra ID and never reach Intune.

A Hyper-V virtual machine also turned out to be a safe place to test all of this, and the same steps can be applied later to a real organisation-owned device. The next step is to apply a configuration policy to the enrolled VM and see how it arrives on the device.