How to Enrol a Windows 11 PC in Microsoft Intune with Entra Join

Joined or registered: the choice that decides what Intune can do

Microsoft Entra ID can give a Windows PC an identity in three ways: registered, joined or hybrid joined. For a first Intune lab only the first two matter. An Entra registered device is the bring-your-own-device model: the PC keeps its local sign-in (often a personal Microsoft account) and a work account is added alongside it. An Entra joined device belongs to the organisation: people sign in to Windows itself with a work account. Microsoft supports joining on Windows 11 and Windows 10 except Home editions, which can register but cannot join.

Neither of those, on its own, is Intune enrolment. Microsoft is explicit that registration is not the same as enrolling a device in mobile device management (MDM). Enrolment is the separate step where the PC accepts an Intune management channel and starts checking in for policy. Automatic enrolment is what joins the two together. When the MDM user scope includes the person signing in, Entra hands Windows the Intune enrolment address during the join and Windows enrols itself without anyone typing a server name. That address is the thing we look for later in dsregcmd output as MdmUrl.

The route you pick in the Settings app matters because the dialog offers both. Entering a work email address in the main box registers the PC: it shows as personal in Intune and, per Microsoft's enrolment guide, the work account is managed but the device is not. Choosing the join option under Alternate actions joins the PC, which then shows as organisation-owned and fully managed whoever is signed in. This article uses the join route, because the rest of the Intune series (policies, apps, security baselines) assumes a managed PC.

Before you begin

Use a disposable lab or an approved test tenant, one test user and one PC you are happy to rebuild. We have written this from Microsoft's documentation as it stood on 30 October 2026 and have not run it against a live tenant for this article. Menu labels move around, so where Microsoft's own pages disagree with each other we say so rather than guess. Microsoft's pages use the American spelling 'enrollment' in portal labels, and we keep those labels exactly as they appear.

• Licences: the test user needs an Intune licence (Plan 1 is enough) and Microsoft Entra ID P1 or P2, because automatic MDM enrolment is a premium Entra feature. In the Intune admin centre, Tenant administration > Tenant status shows how many Intune licences you hold.
• Roles: Microsoft's page for the automatic enrollment setting lists the built-in Global Administrator role, which is the simplest choice in a lab. Changing Entra device settings needs Cloud Device Administrator. Syncing a device later needs a role such as Help Desk Operator.
• A test user and a security group: for example a user called Lab User One in a group called Lab - Windows Enrolment Users. The user's sign-in name (UPN) must use a verified, routable domain. A .local suffix is a known cause of enrolment failure.
• Entra join permission: in the Entra admin centre, open Entra ID > Devices > Device settings and check that Users may join devices to Microsoft Entra ID is set to All, or to Selected with your test user included. If your tenant requires multifactor authentication to register or join devices, the test user needs a working method first.
• Enrolment restrictions: in the Intune admin centre, Devices > Device onboarding > Enrollment > Device platform restriction should allow Windows (MDM). Also check how personally owned Windows devices are treated. Microsoft says that if you block them, automatic enrolment through Entra join from the setup screens or Settings is blocked too, unless the device comes through Windows Autopilot or another corporate route. If your tenant already blocks personal Windows devices, you will need an allowing restriction for the lab group first.
• The PC: Windows 11 Pro, Pro Education, Education or Enterprise. Windows Home cannot be Entra joined. Use a spare PC or a virtual machine, take a checkpoint or image before you start, and do not use a copy of a machine that has already been enrolled, because Intune does not support cloned enrolled devices.
• Nothing precious on the PC. The work account signs in as a new identity on a joined machine, and we have not verified how existing local profile data behaves, so treat this as a clean-ish test box.

Turn on automatic enrolment for the test group only

This is the tenant-side switch. It decides which people, when they join or register a Windows PC, get enrolled in Intune automatically. The scope options are None, Some and All. All is the tempting one and the wrong default for a lab: it would enrol the PC of anyone in the tenant who joins or registers a device, including people just adding a work account to a personal laptop to read email. Some, pointed at a group of one, keeps the blast radius where you can see it.

Setting this up does not touch any device. It only changes what happens on the next join or registration by an in-scope user. To undo it, set the scope back to None. Microsoft notes that devices can still be managed in Intune with the scope at None, but users must start enrolment themselves, so it is a brake on new automatic enrolments rather than a remove-device switch.

1. Sign in to the Microsoft Intune admin centre with an account that holds the Global Administrator role.
2. Go to Devices, expand Device onboarding and select Enrollment. Open the Windows tab and select Automatic Enrollment.
3. If a message says automatic MDM enrollment is only available to Microsoft Entra ID Premium subscribers, the tenant is missing Entra ID P1 or P2. Fix the licensing (Microsoft offers a free Premium trial from that message in a lab) before going on.
4. Set MDM user scope to Some, choose Select groups and add your lab group. Do not choose All.
5. Leave MDM terms of use URL, MDM discovery URL and MDM compliance URL at their default values. If you see a separate WIP user scope setting, set it to None. If a MAM user scope setting is shown, set that to None as well for this exercise, so a bring-your-own-device rule cannot take precedence over MDM enrolment for the same user.
6. Select Save, then give group membership a little time to propagate before you join the PC. Microsoft describes group-based enrolment assignments as typically updating within 15 minutes rather than instantly, so make a drink and do not join the PC the second you save.

Join the test PC to Microsoft Entra ID

There are two ways in, and they end in the same place. On a brand new or freshly reset PC, choose Set up for work or school at the 'How would you like to set up this device?' prompt in the out-of-box experience and sign in with the lab user. Microsoft Entra then checks whether MDM enrolment is required and starts it as part of setup. The Settings route below is for a PC that is already installed.

Joining is the point of no easy return for that PC's identity, so take your checkpoint first. If the PC already has a work account added in Settings > Accounts > Access work or school (that is a registration), disconnect it there before you start, otherwise you are testing a mixed state.

1. Sign in to the test PC with a local administrator account and make sure it has internet access.
2. Open Settings > Accounts > Access work or school and select Connect.
3. Do not type the work email address into the main box. Under Alternate actions, choose the option to join this device to Microsoft Entra ID. Microsoft's enrolment guide still uses the older wording, Join this device to Azure Active Directory, so look for either.
4. Sign in as the lab user and complete any multifactor prompt. Accept the prompts to join.
5. Restart or sign out if Windows asks, then sign in to Windows with the lab user's work account. Enrolment happens in the background and can take a few minutes. Microsoft does not publish a guaranteed time, so give it a little while before assuming it failed.

Check the PC from the inside

Do these checks on the test PC while signed in as the lab user. They only read information and change nothing.

The dsregcmd tool reports the PC's Entra state. Run it in a normal, non-elevated window as the signed-in lab user: Microsoft notes the user and single sign-on sections need a user context, and one field can error when the window is elevated. The filter below prints only the lines we need and leaves out the tenant ID and device ID, but still avoid pasting full dsregcmd output into public forums or tickets.

1. Open Settings > Accounts > Access work or school. You should see the work account listed as connected to Microsoft Entra ID, with a note about the areas your organisation manages.
2. Open Windows PowerShell as the lab user, without choosing Run as administrator, and run the filtered dsregcmd command. It prints the join state, device health, tenant name, MDM address and single sign-on token status.
   powershellCopy

   dsregcmd /status | Select-String -Pattern 'AzureAdJoined|EnterpriseJoined|DomainJoined|WorkplaceJoined|DeviceAuthStatus|TenantName|MdmUrl|NgcSet|AzureAdPrt\s+:'

3. Compare the lines with the next section. If MdmUrl is empty, stop here and go to the troubleshooting section rather than waiting longer.

Reading the dsregcmd output

Microsoft's join-state table is the part to remember: AzureAdJoined YES with EnterpriseJoined NO and DomainJoined NO means Microsoft Entra joined. A registered device does not show up there at all. Registration is reported in the User State section as WorkplaceJoined.

• AzureAdJoined : YES, EnterpriseJoined : NO, DomainJoined : NO - the PC is Entra joined and not tied to Active Directory. YES for both AzureAdJoined and DomainJoined would mean hybrid join, which is a different exercise.
• WorkplaceJoined : NO - no separate registered work account in this Windows user's context. YES here means a work account has been added as a registration, which is the BYOD pattern, not the join you were aiming for.
• DeviceAuthStatus : SUCCESS - the device object exists and is enabled in Entra ID. A failure message saying the device is disabled or deleted points at the Entra device record, not Intune.
• TenantName - should be the lab tenant you expect. This is a quick check that you did not join the PC to the wrong organisation.
• MdmUrl - should hold an Intune enrolment address. Microsoft's own diagnostics page gives the default discovery address as https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc. An empty MdmUrl means either MDM was not configured or the signed-in user is outside the MDM user scope. A populated MdmUrl is a good sign but not proof: Microsoft warns that it can appear whenever the tenant has automatic enrolment configured, even if the PC itself is not managed. The proof is the Intune record below.
• AzureAdPrt : YES - the user has a Primary Refresh Token, the credential Windows uses for single sign-on to cloud resources. NO suggests a sign-in problem rather than an enrolment problem.
• NgcSet : YES or NO - whether the user has a Windows Hello key. Either is fine for this exercise.

Check the admin centres and Company Portal

The PC saying it is joined is only half the story. Intune has to agree, and the check-in time is the quickest sign that the management channel is alive. These checks are read-only apart from the Sync button, which just asks the device to check in.

1. In the Intune admin centre, go to Devices > All devices and find your test PC by name. Look for the device being managed by Intune, owned as corporate (Microsoft says joined devices show as organisation-owned), the lab user as primary user and a recent last check-in time. Column names can differ slightly between portal versions.
2. In the Entra admin centre, go to Entra ID > Devices > All devices and open the same PC. The join type should be Microsoft Entra joined and the MDM column should say Microsoft Intune. Microsoft notes the device counts on the Entra overview page lag by a few hours, but the device record itself is the thing to open.
3. Back in Intune, select the device, choose Sync at the top of the overview pane and confirm. On Windows you can follow progress on the Device sync status tab, which needs the Preview new device view toggle switched on. Refresh the device and the last check-in time should move forward.
4. On the test PC, install Company Portal from the Microsoft Store if it is not there, open it and sign in as the lab user. A correctly enrolled PC should be recognised as already set up. If you are offered the Set up your device prompt, enrolment has not completed. We have not captured the exact post-enrolment Company Portal screens for this article, so treat the absence of that prompt as the check rather than a particular layout.
5. Optional read-only cross-check: from an admin workstation (not necessarily the test PC), query the device through Microsoft Graph PowerShell. Sign-in is interactive and needs consent for the DeviceManagementManagedDevices.Read.All permission, which only reads device data. The script lists every managed device and filters in PowerShell, which is fine for a lab but heavy for a large tenant. Look at the ownership type, enrolment type and last sync time. We have not confirmed which enrolment type value an Entra join produces, so do not treat any single value as the expected answer. Install the module first only if you do not already have it.
   powershellCopy

   Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUser

   powershellCopy

   Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All'
   Get-MgDeviceManagementManagedDevice -All | Where-Object { $_.DeviceName -eq 'LAB-W11-01' } | Select-Object DeviceName, ManagedDeviceOwnerType, DeviceEnrollmentType, ManagementAgent, EnrolledDateTime, LastSyncDateTime, ComplianceState, UserPrincipalName, OperatingSystem, OsVersion | Format-List

If the PC joined but did not enrol

Start with the order of events. The most common pattern is a join that happened before the tenant side was ready, so the PC never received an enrolment address. Work from the symptom.

• Joined, but MdmUrl is blank and the PC is not in Intune: the user was outside the MDM user scope, was missing an Intune or Entra ID P1 licence, or the scope was saved after the join. Fix the scope or licence, allow time for group membership to catch up, then retry the join on a clean PC (reverting your checkpoint is the cleanest route) and delete the stale device records first. If everything looks right and MdmUrl is still blank, an independent engineer has documented a case where an extra, invalid MDM policy object in the tenant stopped Entra issuing the URL. That is a specialist Graph-level investigation, not a first step.
• Two records for one PC in Intune: Microsoft's explanation is that automatic enrolment was off when the device joined. Its fix is to go to Settings > Accounts > Access work or school on the PC, select Connect and use the same work account again.
• 0x80180014 'Your organization does not support this version of Windows': Windows (MDM) enrolment is blocked. Check Devices > Device onboarding > Enrollment > Device platform restriction and allow Windows (MDM) for the user's restriction. Also check the personal-device rule described earlier.
• 0x8018000a 'The device is already enrolled': another user has already connected the PC to a work or school account. Sign in as that user, remove the account in Settings > Accounts > Access work or school, then retry with the lab user.
• 'This account is not allowed on this phone' or 0x80180018: the user has no valid Intune licence. Assign one and retry. A message that Windows cannot connect to the URL for your organisation's MDM terms of use usually means a missing licence too, or a blank terms of use URL under Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune. Restore default MDM URLs there if so.
• 0x80180013 or 0x801c000e, 'too many devices or users': a device limit has been reached. Entra join defaults to a 50-device limit per user, and Intune device limit restrictions do not apply to Entra joined enrolments, so check the Entra device settings.
• Windows Home: Entra join is not available. The same machine can only register. Upgrade the edition or use another PC.
• 0x8007064c 'The machine is already enrolled': usually a previous enrolment or a cloned image of an enrolled machine. Microsoft's fix involves deleting an old Intune certificate and registry keys, which is a registry change. On a lab VM it is quicker and safer to rebuild from a clean image.
• Nothing obvious on screen: read the device's own enrolment log. Microsoft documents event ID 75 as successful automatic enrolment and 76 as failed, with the error code in the event. Its guidance describes this in the Group Policy path, but the log is the right place for any automatic enrolment. Error 0x8018002b is attributed to an unverified or non-routable UPN suffix or a scope set to None. You may need an elevated PowerShell window to read the log, and the command only reads.
  powershellCopy

  Get-WinEvent -LogName 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin' -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName -AutoSize

Undoing the lab, and what this does not cover

Rolling back means two separate things: stop new automatic enrolments, and get the test PC out of management. You can do either independently.

Retiring a device in Intune stops Intune managing it. Microsoft's guidance is that a device managed by another system such as Intune should be wiped or retired before its Entra record is deleted. Deleting a device from Entra ID is not recoverable, removes details attached to the device such as BitLocker keys, and prevents it accessing Entra resources. Only do that for a disposable test PC, never on a PC whose recovery key you might need. Wipe is a destructive reset and is not needed to undo this exercise.

• Stop new automatic enrolments: set MDM user scope back to None, or remove the user from the lab group.
• Remove the test PC: select it in Intune and use Retire, then delete its stale Entra record if you are rebuilding it. Alternatively revert the VM to the checkpoint you took before joining, then clean up the leftover Intune and Entra device records.
• Not covered here: Windows Autopilot, Entra hybrid join, Group Policy enrolment, bring-your-own-device registration and MAM, Windows 10, shared or kiosk PCs and anything that assigns policy, apps or compliance rules. Those come in later articles in this series. Until you assign something, a freshly enrolled PC is managed but not configured.
• Not tested: the click paths, labels and the Graph script in this article have been compared with Microsoft's current documentation but have not been run end to end in a tenant for this article. Check them against your own portal before relying on them.