Intune Device Enrollment
Every existing Windows device in Intune. Compliance enforced. Hybrid Join or Entra Join as the foundation for device-based Conditional Access.
Your Existing Windows Devices Are Not in Intune — and Nobody Has Time to Migrate Them
Fifty Windows laptops, three offices, two people in IT. The devices joined the domain years ago. Group Policy handles most settings. Patch status is a best-effort report from the WSUS console. Encryption? You hope BitLocker is on. When a customer audit asks for a compliance report, the honest answer is a spreadsheet that's already out of date.
This is not a failure of your IT team. Bringing existing Windows devices into Intune is not one switch. It requires Microsoft Entra hybrid join or Entra join, Entra Connect with the right attributes synced, two public DNS CNAME records, a GPO that triggers automatic MDM enrollment, and a compliance policy that does not lock everyone out. Each piece is documented; the sequence is not.
Traditional consulting for an MDM rollout? Two months, five figures. The consultant configures, documents, leaves. Your team inherits settings they did not decide.
ACTIVITIES IN DETAIL
DELIVERABLES
Review of license situation (Intune Service Plan 1, Entra ID P1) and technical prerequisites
Capture the existing Windows device provisioning workflow — imaging, domain join, GPO baseline, Configuration Manager if present
Define the necessary steps for Microsoft Entra hybrid join or Entra join as the device-based authentication prerequisite for automated Intune enrollment
Configure public DNS CNAME records (
EnterpriseEnrollmentandEnterpriseRegistration) to enable auto-discovery of the Intune enrollment serverDefine the compliance standard: BitLocker encryption, minimum OS version, firewall active, Microsoft Defender Antivirus active, Secure Boot
Configure and monitor asynchronous Intune device enrollment for existing managed Windows devices in Active Directory — via GPO “Enable automatic MDM enrollment”
Define the solution approach for unmanaged Windows devices: manual enrollment flow, Company Portal deployment, user self-service guide
Implement exemplary further Intune scenarios: simple software distribution (one business app) and an endpoint configuration profile as a proof-of-value for the wider rollout
Staged wave rollout by site or OU — pilot group first, monitor the Intune compliance report, then wave-based rollout
Integrate compliance status with Conditional Access for device-based access control
Next steps after Intune Device Enrollment
A cleanly configured tenant is the foundation. These blueprints build directly on it
