How to Enroll Windows Devices in Microsoft Intune (5 Ways Explained)

Imagine it’s your first day at a new job. A brand-new laptop shows up at your door. You open it, sign in with your work email, and ten minutes later it already has your apps, your Wi-Fi and your security settings. Nobody from IT ever touched it.

How does that happen? One word: enrollment. This article walks through the five main ways to get a Windows device into Intune, what each one does and when to use it.

What is enrollment?

Microsoft Intune is a cloud service that helps organizations manage their devices: laptops, desktops and phones. It pushes settings, installs apps and keeps devices secure, all over the internet. But Intune can’t manage a device it doesn’t know.

Enrollment is the moment a device introduces itself to Intune: “I belong to this organization, you can manage me now.” Think of it like checking into a hotel. Before check-in you’re just a person in the lobby. After check-in you have a room key, the Wi-Fi password and access to the gym.

Once a device is enrolled, Intune can apply security policies, deploy apps, keep Windows updated and, if the laptop gets lost, wipe the company data remotely.

There’s one more partner to know: Microsoft Entra ID (formerly Azure Active Directory). Entra ID is the identity system, the place that knows who you are. Intune is the management system, the place that decides what your device should look like. They work as a team.

Five ways to enroll

Picking the right method comes down to three questions:

1. Who owns the device? Personal devices (BYOD) use user-driven enrollment: the user opens Settings > Accounts > Access work or school and connects their work account.
2. Is it brand new or already in use? Brand-new company devices go through Windows Autopilot and set themselves up out of the box. Many devices at once, or shared kiosks, use bulk enrollment with a provisioning package.
3. Is it managed by Configuration Manager today? If it is, co-management lets Configuration Manager and Intune work side by side. If not, automatic enrollment does the job, through Microsoft Entra join or with Group Policy for domain-joined PCs.

Before you start

• A supported version of Windows. Windows 10 reached end of support on October 14, 2025. Intune still allows Windows 10 devices to enroll, but Microsoft says functionality isn’t guaranteed, so move to Windows 11 where you can.
• Licensing. Users need at least an Intune Plan 1 license. Automatic enrollment and Autopilot also need Microsoft Entra ID P1 or P2; user-driven enrollment doesn’t. Check Microsoft Learn to see what your plan includes.
• The MDM user scope. In the Intune admin center, this decides which users can automatically enroll their devices: None, Some or All. Some with a small group is a good way to start a pilot.
• A DNS record (optional). A CNAME called EnterpriseEnrollment on your domain lets Windows find the enrollment server when users type their email. The admin center has a button to test it.

Method 1: Automatic enrollment

This is the foundation: Autopilot and co-management are both built on top of it. A user signs in with their work account, the device joins Microsoft Entra ID and, because the user is in the MDM user scope, Intune enrolls it automatically. Identity first, then management.

• New company laptop: it happens during normal Windows setup. Pick a language, connect to Wi-Fi, sign in with the work email.
• Already set up with a personal account: Settings > Accounts > Access work or school > Connect, then under alternate actions choose Join this device to Microsoft Entra ID and sign in with the work account.
• PCs joined to on-premises Active Directory and synced to the cloud: use Group Policy and turn on Enable automatic MDM enrollment using default Microsoft Entra credentials.

Two rules: Group Policy enrollment is for company devices only, and a device managed by another MDM has to leave it first.

Method 2: Windows Autopilot

Autopilot takes a brand-new laptop from the box to fully managed without IT touching it. The old way meant unboxing every device, wiping it and installing a custom company image. Autopilot skips all of that and uses the Windows the manufacturer already installed. It’s for company devices and is built on automatic enrollment, so it also needs Entra ID P1 or P2.

1. The device’s hardware ID is registered with Autopilot, often by the manufacturer or reseller.
2. IT creates a deployment profile in Intune and assigns it to a group of devices. The profile shapes setup, for example skipping the license screen.
3. The laptop ships straight to the employee, who turns it on, connects to the internet and signs in. Autopilot takes over.

Mode	What it does
User-driven	The most common: the user signs in and setup begins.
Pre-provisioning	Does the heavy lifting in advance, so setup is faster for the user.
Self-deploying	No user at all, for kiosks and meeting rooms.
Autopilot for existing devices	Reinstalls Windows on PCs you already own, so the drive is wiped.

For hybrid join with on-premises Active Directory you also need the Intune Connector for Active Directory.

Method 3: User-driven enrollment

This one is for personal devices and for company PCs that are already set up, and it doesn’t need Entra ID P1 or P2. The user opens Settings > Accounts > Access work or school > Connect, and the choice they make matters:

• Typing the work email address registers the device with Microsoft Entra ID as a personal device. Whether Intune also enrolls it depends on your MDM user scope, and IT has far less control than with a join.
• Join this device to Microsoft Entra ID joins the device to the organization, and IT can manage the whole device. On your own PC, only join if you’re comfortable with that.
• Enroll only in device management exists too, but Microsoft doesn’t recommend it for personal devices because it skips registration with Entra ID.

It needs a person to sign in, so it’s not for shared or kiosk devices, and for company devices Autopilot or automatic enrollment take fewer steps.

Method 4: Bulk enrollment

For setting up many devices at once: a classroom, a warehouse, a fresh batch of PCs. IT builds a provisioning package with Windows Configuration Designer (free in the Microsoft Store). The package carries the settings and a bulk token that lets each device join the organization without anyone signing in.

Copy it to a USB drive and plug it into a new PC during Windows setup: the device joins Microsoft Entra ID and enrolls in Intune by itself. A PC that’s already set up can run the package from a network folder.

• Automatic enrollment has to be turned on first.
• The bulk token expires after 180 days, so the package needs rebuilding now and then.
• Multifactor authentication isn’t supported here, so admins exclude this process from it.

There’s also the device enrollment manager, a special account (not an admin) that can enroll up to 1,000 devices. A regular user tops out at 15.

Method 5: Co-management

For organizations that already use Configuration Manager and want to move to Intune without starting over. The same Windows device is managed by Configuration Manager and Intune at the same time.

Most organizations start with devices that already run the Configuration Manager client and are joined to on-premises Active Directory: make them hybrid joined with Microsoft Entra ID, turn on co-management, and the client enrolls them in Intune automatically.

Then you split the work. Compliance policies, Windows Update, device configuration and apps are each a workload, and each workload has a slider: Configuration Manager, Pilot Intune for a test group, or Intune for everyone. Move one at a time, at your own pace. You’ll need Entra ID P1 or P2, automatic enrollment and a supported version of Configuration Manager.

Which one should you pick?

Situation	Method
Brand-new company laptops	Windows Autopilot
Many devices at once, or kiosks	Bulk enrollment
Company PCs already in use	Automatic enrollment (Group Policy for domain-joined PCs)
Personal devices	User-driven enrollment
You already run Configuration Manager	Co-management

You don’t have to pick just one: many organizations use several side by side. Entra ID knows who you are, Intune knows what your device should look like, and now you know five ways to get there.

Which method do you use, and why? Tell me in the comments.