Auto-Enrollment & Bulk Enrollment
Enrolling devices one by one doesn't scale. Learn how auto-enrollment uses Entra ID join to trigger Intune enrollment, and how bulk enrollment handles iOS, Android, and Windows at volume.
Why auto-enrollment?
Imagine a gym where signing up at the front desk also gives you a locker key — automatically.
That’s auto-enrollment. When a Windows device joins (or registers with) Microsoft Entra ID, it automatically enrolls in Intune too — no extra steps. One action, two outcomes: cloud identity AND device management.
For iOS and Android at scale, bulk enrollment methods skip the one-by-one setup entirely — you configure once, and hundreds of devices enroll themselves when unboxed.
Windows auto-enrollment
Sam at Tui Solutions wants every Windows device to enroll in Intune the moment it joins Entra ID. Here’s how:
Setup (3 steps)
- Entra admin center → Mobility (MDM and MAM) → Microsoft Intune
- Set MDM user scope to “All” (or a specific group)
- Optionally set MAM user scope for app-level management of unmanaged devices
| Scope Setting | What It Does |
|---|---|
| MDM user scope = All | Every user’s device auto-enrolls when Entra Joined or Hybrid Joined |
| MDM user scope = Some | Only devices belonging to users in the selected group auto-enroll |
| MDM user scope = None | No auto-enrollment (manual enrollment only) |
| MAM user scope | Enables app protection without full device enrollment (for registered/BYOD devices) |
What triggers auto-enrollment?
| Action | Result |
|---|---|
| Entra Join (Windows OOBE or Settings) | Device auto-enrolls in Intune MDM |
| Hybrid Join (via Entra Connect + GPO) | Device auto-enrolls via GPO trigger or Entra Connect |
| Entra Registration (personal device) | Auto-enrolls in MAM only (if MAM scope configured) |
| Windows Autopilot | Uses auto-enrollment as part of the provisioning flow |
Exam tip: MDM scope vs MAM scope
The exam tests whether you know the difference:
- MDM scope = full device management (Entra Joined or Hybrid Joined devices)
- MAM scope = app-level management only (Entra Registered / BYOD devices)
If a user’s device is Entra Joined and the MDM scope is set to “All,” the device automatically enrolls for full management. If a personal device is Entra Registered and only MAM scope is set, only app protection policies apply — Intune doesn’t manage the device itself.
Licence requirement: Entra ID P1 or P2 is required for auto-enrollment. This is included in M365 E3/E5 but NOT in M365 Business Basic.
iOS/iPadOS bulk enrollment
For corporate-owned iPhones and iPads, Apple provides Automated Device Enrollment (ADE) through Apple Business Manager (ABM).
How it works
- Apple Business Manager — your org registers with Apple and gets an ABM account
- Link ABM to Intune — download a token from ABM, upload it to Intune
- Assign devices to Intune — when you purchase devices through Apple or authorised resellers, serial numbers appear in ABM
- Create an enrollment profile — define settings (supervised mode, skip setup screens, etc.)
- User unboxes the device — it connects to Wi-Fi, contacts Apple, gets redirected to Intune, and enrolls automatically
| ABM Feature | What It Does |
|---|---|
| Supervised mode | Gives full management control — required for many enterprise restrictions |
| Skip Setup Assistant screens | Users skip Apple ID, location, Siri, etc. during setup |
| Assign to Intune MDM server | Devices automatically point to your Intune tenant |
| User affinity | Optional: associate the device with a specific user (for personal corporate devices) |
Key exam concept: ADE devices are supervised by default, giving admins the deepest level of control. This is different from user-enrolled iOS devices, which have limited management.
Android enrollment profiles
Android has the most enrollment options because Google offers different management levels. Sam needs to understand all four for Tui Solutions’ mixed Android fleet.
| Feature | Fully Managed | Dedicated | Corporate Work Profile | Personal Work Profile |
|---|---|---|---|---|
| Device ownership | Corporate | Corporate (shared) | Corporate | Personal (BYOD) |
| User affinity | Yes (one user) | No (shared) | Yes (one user) | Yes (one user) |
| Admin control level | Full device | Full device (kiosk/signage) | Work profile + device-level | Work profile only |
| Personal apps allowed | Admin decides | No (single-purpose) | Yes, in personal profile | Yes (device owner controls) |
| Enrollment method | QR code, NFC, token, zero-touch | QR code, NFC, token, zero-touch | QR code, NFC, token, zero-touch | Company Portal app |
| Best for | Corporate-only phones/tablets | Kiosks, shared tablets, digital signs | Corporate phone where user also has personal apps | Employee's own phone accessing work email |
| Factory reset required | Yes | Yes | Yes | No |
Android enrollment setup
- Connect to Managed Google Play — link your Intune tenant to Google’s enterprise service
- Create enrollment profiles — one per management type (fully managed, dedicated, etc.)
- Generate enrollment tokens — QR codes or NFC tags for corporate devices
- For BYOD — users install Company Portal from Google Play and sign in
Deep dive: Android zero-touch enrollment
Zero-touch enrollment is Google’s equivalent of Apple’s ADE. Devices purchased from participating resellers are pre-registered with your Intune tenant. When a user turns on the device, it automatically configures itself without any manual steps.
Requirements:
- Device must be purchased from a zero-touch reseller
- Device must run Android 9.0 or later
- Intune tenant must be linked to Managed Google Play
This is the most seamless Android enrollment method for corporate devices. Samsung also offers Samsung Knox Mobile Enrollment (KME) — a similar OEM-specific alternative that works with Samsung devices running Knox 2.8+.
Bulk enrollment for Windows
For Windows devices that can’t use Autopilot (e.g., no internet during setup), provisioning packages offer offline bulk enrollment:
- Use Windows Configuration Designer (WCD) to create a .ppkg file
- Include Entra join settings, Intune enrollment, Wi-Fi config, and apps
- Apply the package via USB or network share during OOBE
- Devices join Entra ID and enroll in Intune without internet (settings apply when connected)
We’ll cover provisioning packages in detail in Module 10.
🎬 Video walkthrough
Flashcards
Knowledge Check
Sam configures auto-enrollment with MDM user scope set to 'All.' A user joins their corporate laptop to Entra ID. What happens next?
Riko at Pixel & Co needs to set up 20 new corporate-owned iPads for the design team. The iPads were purchased through an Apple authorised reseller. What's the most efficient enrollment method?
A company needs kiosk tablets in their retail stores that display a single inventory app. No user signs in — the tablets are shared. Which Android enrollment type is correct?
Next up: Intune RBAC & Windows Hello for Business — controlling who can do what in Intune, and going passwordless.