Managing devices efficiently is a cornerstone of modern IT, and Microsoft Intune offers robust solutions to simplify this task. If you’re curious about how to enroll a device in Intune, this blog post covers two effective methods: automatic enrollment via Group Policy and using Intune Autopilot with PowerShell. These approaches cater to different environments, ensuring flexibility and ease for IT admins.
Method 1: Enroll a Windows Device Automatically Using Group Policy
Automating enrollment with Group Policy is a great way to address how to enroll a device in Intune, especially in hybrid setups with on-premises Active Directory (AD) synced to Azure AD. Here’s how to set it up, based on Microsoft’s documentation (source):
- Prerequisites:
- Hybrid Azure AD-joined environment (AD synced with Azure AD).
- Windows 10/11 devices (version 1709 or later).
- Intune licenses assigned to users.
- Domain-joined devices and Group Policy Management Console access.
- Configure MDM Enrollment:
- Open Group Policy Management Console on your domain controller.
- Create or edit a Group Policy Object (GPO): Go to Computer Configuration > Policies > Administrative Templates > Windows Components > MDM Enrollment.
- Enable “Auto MDM Enrollment with AAD Credentials” and configure it to use Azure AD credentials. This ties devices to Intune’s MDM URL (https://enrollment.manage.microsoft.com).
- Apply the GPO:
- Link the GPO to an Organizational Unit (OU) with your target devices or users.
- Run gpupdate /force on a device to apply instantly, or wait for the next refresh cycle.
- Verify Enrollment:
- Restart the device or manually trigger enrollment via Settings > Accounts > Access work or school > Connect (if needed).
- Check Devices > All Devices in the Intune Admin Center (https://intune.microsoft.com/) to confirm enrollment with a “Compliant” status.
This method automates enrollment for domain-joined devices, making it ideal for large-scale deployments in hybrid environments.
Method 2: Using Intune Autopilot with PowerShell (-Online Option)
For a cloud-centric approach, Intune Autopilot revolutionizes how to enroll a device in Intune by pre-configuring devices for users right out of the box. Using the PowerShell script Get-WindowsAutoPilotInfo.ps1 with the -Online parameter, you can register devices directly without manual CSV uploads. Here’s the process, adapted from Microsoft’s guidance (source):
- Prerequisites:
- Intune subscription with Autopilot enabled.
- Admin access to Intune Admin Center.
- Windows 10/11 device (version 1809 or later).
- PowerShell installed on the device or a management PC.
- Install the Script:
- Open PowerShell as an administrator.
- Install the script from PowerShell Gallery:
Install-Script -Name Get-WindowsAutoPilotInfo - Accept prompts to install from PSGallery.
- Run the Script with -Online:
- Execute the script on the target device with the -Online parameter:
Get-WindowsAutoPilotInfo.ps1 -Online - You’ll be prompted to sign in with an Azure AD account that has Intune admin privileges. This directly uploads the device’s hardware hash (serial number, hardware ID, etc.) to Intune, skipping the CSV step.
- Execute the script on the target device with the -Online parameter:
- Confirm Registration:
- In the Intune Admin Center (https://intune.microsoft.com/), go to Devices > Windows > Windows Enrollment > Devices.
- Verify the device appears in the list, typically within minutes.
- Assign an Autopilot Profile:
- Navigate to Devices > Windows > Windows Enrollment > Deployment Profiles.
- Create or assign a profile (e.g., skip welcome screens, pre-install apps) and link it to a device group containing the registered device.
- Deploy the Device:
- Reset the device to factory settings (manually or via Autopilot Reset).
- On first boot with an internet connection, it enrolls in Intune and applies the Autopilot profile, delivering a customized setup.
The -Online option streamlines the process by eliminating file exports, making it faster and more efficient for smaller batches or one-off enrollments.
Why These Methods Stand Out
- Group Policy: Perfect for hybrid setups with AD infrastructure, offering hands-off enrollment for domain-joined devices.
- Intune Autopilot with -Online: Ideal for cloud-native environments, providing a seamless, automated experience with real-time registration via PowerShell.
Final Thoughts
Mastering how to enroll a device in Intune unlocks powerful management capabilities for your organization. Group Policy suits traditional setups, while Intune Autopilot with Get-WindowsAutoPilotInfo.ps1 -Online caters to modern, cloud-first workflows. Choose the method that aligns with your infrastructure, and start enrolling devices with confidence today!
How to Enroll a Polycom Phone in Microsoft Intune
Polycom (Poly) Teams phones enroll in Intune as Android Device Administrator devices, not as standard corporate Android devices. This distinction catches most administrators out on the first attempt. Because Device Administrator enrollment is disabled by default on newly created tenants, the first step is not enrolling the phone at all — it is enabling the enrollment method itself.
Prerequisites
- Intune set as your organization’s MDM authority
- Android Device Administrator enrollment enabled in your tenant (off by default)
- The MAC address printed on the back of the device — Poly phones report this value in place of a traditional serial number
- A Teams phone resource account created in Microsoft 365 with a valid Teams Phone license
Step 1: Enable Android Device Administrator Enrollment
In the Intune admin center, go to Devices > Enrollment > Enrollment options and enable Device Administrator enrollment for your tenant. If this remains disabled, the phone will never complete enrollment regardless of what else is configured correctly.
Step 2: Confirm Intune Is Your MDM Authority
Under Tenant administration, verify the MDM authority is set to Intune. Devices cannot enroll until this is configured, and the resulting failure message rarely points at the actual cause.
Step 3: Register the Device by MAC Address
Navigate to Devices > Enrollment > Corporate device identifiers and add the device using the MAC address printed on the back of the phone. This is the step that most often goes wrong: Poly hardware reports the MAC address where other vendors report a serial number, so entering an actual serial number here causes enrollment to fail silently with no useful error.
Step 4: Assign a Compliance Policy
Create an Android Device Administrator compliance policy under Devices > Compliance policies > Create policy, then assign it to the group containing your Teams phone resource accounts — not to individual user accounts. Resource accounts behave differently from standard user accounts, and targeting the wrong object leaves the device permanently in a “not evaluated” state.
Step 5: Complete Enrollment on the Device
Sign in on the physical phone using its Teams phone resource account. Once signed in, the device checks in with Intune automatically using the Device Administrator protocol and appears in your device inventory within a few minutes.
Common Polycom Enrollment Issues
- Device does not appear after sign-in. Re-check the MAC address character by character. A single mismatched character prevents the corporate device identifier from matching, and Intune gives no indication that a near-miss occurred.
- Compliance shows “Not evaluated.” Confirm the compliance policy targets the correct group and that the device enrolled through Device Administrator rather than Android Enterprise.
- The phone cannot sign in at all. Verify the resource account holds a valid Teams Phone license and is not being blocked by a Conditional Access policy that excludes unmanaged or non-compliant devices.
- Device enrolls but policies never apply. Teams phones check in less frequently than mobile devices. Allow time before assuming failure, or restart the device to force a check-in.
For a full walkthrough of the portal itself, including navigation and permissions, see our guide to the Microsoft Intune Admin Center.