Set Up Device Enrollment in Microsoft Intune – The Right Way - 2026 Guide

Use these methods for company-owned devices.

• Entra ID Join + Automatic Intune Enrollment
  For new Windows 10/11 PCs that auto-enroll during user sign-in
  Also supports Hybrid Entra ID Join via Group Policy
• Windows Autopilot
  Zero-touch provisioning for Windows devices
  Devices enroll automatically during first boot
• Apple Automated Device Enrollment (ADE)
  Hands-off enrollment for corporate iOS, iPadOS, and macOS
  Uses Apple Business Manager or Apple School Manager
• Android Enterprise (Fully Managed / COPE)
  For corporate Android devices with full management control
• Device Enrollment Manager (DEM)
  Enroll multiple shared or kiosk devices using one service account
• Windows Provisioning Package
  Offline or bulk enrollment using a provisioning package
  Useful for labs or isolated environments

Use these methods for personal devices.

• Intune Company Portal (User-Driven)
  Users enroll their own devices through the Company Portal app
  Supports Windows, iOS, and Android
• Apple User Enrollment
  Privacy-focused BYOD enrollment for iPhone and iPad
  Keeps work data separate from personal data
• Android Work Profile
  Creates a secure work profile on personal Android devices
• Entra ID Registration with MDM
  For personal Windows devices enrolled through Settings

This is the primary method for enrolling corporate Windows devices.
Use it for new laptops or when re-setting up an existing one.

New Device (Out-of-Box Experience)

1. Power on the Windows 10/11 device
2. Go through the initial setup screens
3. When prompted, select Set up for work or school
4. Sign in using your Microsoft Entra ID work account
5. The device:
   • Joins Entra ID
   • Automatically enrolls in Intune
6. Intune applies policies and apps
   • If Enrollment Status Page is enabled, progress is shown

Verify Enrollment

• On the device:
  • Go to Settings > Accounts > Access work or school

• • Confirm the device shows connected and managed

• In Intune:
  • Go to Devices
  • Confirm the device appears and is compliant

Once enrolled, the device is marked corporate-owned.
Users cannot remove management without admin permissions.

Windows Autopilot builds on Entra ID join with full automation.
It’s ideal for large-scale or remote deployments.

Setup (IT Side)

1. Capturing the Windows Autopilot Hardware Hash

For Windows Autopilot enrollment, each device must be registered in Intune using its hardware hash. This hash is typically collected after the device has completed Windows Setup (OOBE).

Method 1: Save the hardware hash locally on a device as a CSV file

1. Sign in to the device.
2. Open Windows PowerShell as Administrator.
3. Run the following commands:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

New-Item -Type Directory -Path "C:\HWID"

Set-Location -Path "C:\HWID"

$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Install-Script -Name Get-WindowsAutopilotInfo

Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

Reference: Manually register devices with Windows Autopilot | Microsoft Learn

Note: On first run, the Get-WindowsAutopilotInfo.ps1 script prompts to approve the required app registration permissions.

The hardware hash is saved locally on the device in the directory C:\HWID with the filename AutopilotHWID.csv. The CSV file can then be used to import the device into an MDM service such as Intune.

For Bulk devices

In environments using third-party management tools such as Active Directory (on-prem AD) or tools like ManageEngine, you can deploy the Get-WindowsAutopilotInfo.ps1 script remotely to multiple devices using a startup script, GPO, or remote execution feature. Each device can save its hardware hash to a centralized network share (for example, \\Server\Autopilot\HWID\%ComputerName%.csv).

All collected hashes can then be consolidated into a single CSV file and uploaded in bulk via:

Microsoft Intune Admin Center → Devices → Windows → Windows enrollment → Devices → Import

Method 2: Directly upload the hardware hash to an MDM service

Instead of saving the hardware hash as a CSV file, you can upload it directly to Microsoft Intune using PowerShell. This works for both new devices in OOBE and existing devices, and is especially useful during initial setup.

1. On a device that is:

Sign into the device.

Open an elevated Windows PowerShell prompt.

2. At the PS PowerShell command prompt, run the following PowerShell commands:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

 Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

 Install-Script -Name Get-WindowsAutopilotInfo -Force

 Get-WindowsAutopilotInfo -Online

2. Verify the hardware hash uploaded

To confirm the hardware hash for the device was uploaded into Intune and that the device shows as a Windows Autopilot device:

1. Sign into the Microsoft Intune admin center.
2. In the Home screen, select Devices in the left hand pane.
3. In the Devices | Overview screen, under By platform, select Windows.
4. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.
5. In the Windows | Windows enrollment screen, under Windows Autopilot, select Devices.

6. In the Windows Autopilot devices screen, select Sync in the toolbar.

7. Wait for the sync to finish. The sync might take several minutes.
8. After the sync completes and the device appears in the device list in the Windows Autopilot devices screen in Intune, the device is ready for a Windows Autopilot deployment as long as a Windows Autopilot profile is assigned to the device.

3. Creation and Assignment of Autopilot Profile to the Device

1. 1. Go to Intune Admin Center
      Devices → Windows → Windows enrollment → Deployment profiles

2. Select + Create profile

• • Platform: Windows PC

3. Configure basic settings:

• • Assign a profile name

• • Set Join type to Microsoft Entra ID
  • Configure Out‑of‑box experience (OOBE) options as required
    (user interaction is minimal in self‑deploying mode)

4. Review and Create the profile
5. Assign the profile to the Autopilot device or device group

1. User unboxes the device
2. Powers it on and connects to the internet
3. Signs in with work credentials
4. Autopilot automatically:
   • Joins Entra ID
   • Enrolls in Intune
   • Applies apps and policies

• No imaging required
• Devices can be shipped directly to users
• Consistent configuration

Apple Device Enrollment (ADE) is the recommended enrollment method for company‑owned Apple devices. It provides a zero‑touch, secure, and non‑removable enrollment experience by integrating Microsoft Intune with Apple Business Manager (ABM).

ADE ensures devices are automatically enrolled into Intune during first boot and placed into Supervised mode, giving IT full control from day one.

Setup Requirements

Step 1: Create an Apple Business Manager Account

To create an Apple Business Manager (ABM) account, by visiting business.apple.com and signing in with a company-owned Apple ID.

Verify your organization details, complete the enrollment process, and assign an Administrator to start managing devices and Apple services.

Step 2: Create an MDM Server in Intune (Public Key Generation)

1. Sign in to the Microsoft Intune admin center
2. Go to Devices and expand By platform. Select iOS/iPadOS.

3. Expand Device onboarding, and then select Enrollment > Enrollment program tokens.

4. Select Create.
5. Accept the permission agreement and select Download your public key to download the server's public key certificate (a .pem file) to your local drive.
6. Download the public key certificate (.pem file) to your local drive.

7. Select Create a token via Apple Business Manager and sign in to Apple Business Manager with your company Apple ID.

• Go to Intune admin center
• Navigate to: Devices → Enrollment → Apple → Enrollment program tokens

• Select the ABM token you already connected
• Click Profiles

• Select Create profile
• Platform: macOS / iOS / iPadOS

• In Basics, enter a profile name and optional description to identify the ADE profile.
• In Management Settings, configure:
  • User affinity as Enroll with user affinity
  • Authentication method as Setup Assistant with modern authentication
  • Enable Locked enrollment

• • In Setup Assistant, use Toggle All or individual options to show or hide Apple setup screens as per organizational requirements.

• In Account Settings, define whether:
  • A local administrator account should be created
  • A local primary user account is required
• Review all configured settings and select Create to finalize the ADE enrollment

Step 4: Assign devices to the ADE profile in Apple Business Manager

Assign devices to the Intune MDM server in ABM

1. Sign in to Apple Business Manager
2. Go to Devices from the left navigation pane.

3. Search devices by Serial Number / Order Number
4. Select the required devices
5. Click Assign Device Management.

6. From the Device Management Service dropdown, choose the MDM server linked to Microsoft Intune.

7. Click Continue, then select Assign to confirm.

Verify devices appear in Intune

1. Go to Intune admin center
2. Navigate to Devices > Enrollment > Apple > Enrollment program tokens
3. Open your ABM token
4. Select Devices
5. Click Sync

Assign the ADE enrollment profile (Intune side)

1. Go to Devices > Enrollment > Apple > Enrollment program tokens
2. Open the ABM token
3. Select Profiles
4. Open your ADE enrollment profile
5. Click Assign
6. Select the synced devices
7. Click Assign

Android Enterprise is the recommended method for corporate Android devices.

• Ensure the Android device is factory reset
• Power on the device and begin initial device setup
• Connect a Google account to Intune

Fully Managed (Work-Only Devices)

• Sign in to Microsoft Intune admin center
• Navigate to Devices > Enrollment > Android > Corporate-owned, fully managed user devices

• Click Create policy

• On the Basics page, enter:
  • Name (enrollment profile name)
  • Description (optional)
  • Token type
    • Corporate-owned, fully managed (default)
    • Corporate-owned, fully managed, via staging

• Select Next to continue to Device group.

Tip: Be sure to select a device group, not a user group.

• Select Next to continue to Review + create
• Review the summary of your profile, and then select Create to finalize it.

Get the Enrollment Token

• Open the enrollment profile you just created
• Go to the Token section
• Copy the enrollment token
• (Optional) Download the QR code

Prepare the Android Device

• Ensure the device is factory reset
• Power on the device
• Begin initial device setup
• Start Android Enterprise provisioning during setup
• Use the enrollment token or QR code when prompted

Complete Device Enrollment

• Allow installation of Android Device Policy
• Sign in with a work or school account
• Wait for enrollment to complete
• Device finishes setup as Fully Managed

Verify Device in Intune

• Sign in to Intune admin center
• Go to Devices > All devices
• Confirm the device appears:
  • Platform: Android Enterprise
  • Ownership: Corporate
  • Enrollment type: Fully Managed

The core process is similar across platforms.

Step 1: Install Company Portal

Users install the Microsoft Intune Company Portal app from:

• Microsoft Store (Windows)
• App Store (iOS/iPadOS)
• Google Play Store (Android)

Step 2: Sign In with Work Account

Users sign in using their Microsoft 365 work credentials.

Step 3: Approve Device Enrollment

The device is registered with Microsoft Entra ID and enrolled into Intune.

Step 4: Work Boundary Is Created

Depending on the platform:

• Windows → Device becomes Entra ID Registered
• iOS → User Enrollment creates a managed container
• Android → A secure Work Profile is created

At this point:

• The device is marked as Personal in Intune
• IT can enforce compliance policies
• Corporate data becomes protected

Intune collects only what it needs to secure work data.

Intune can see:

• Device model and OS version
• Compliance status
• Managed (work) apps

Intune cannot see:

• Personal photos or messages
• Personal emails or documents
• Browsing history or call logs

When a user unenrolls or leaves:

• Work apps and data are removed
• Personal data stays untouched

This balance makes BYOD secure without invading privacy.