Intune Enrolment

[Erasure]

Hi

 

Hoping someone can help.

 

We are gradually adopting Intune and have enrolled 300 windows 11 devices so far. We still use an Active Directory so all these devices are Hybrid joined and were enrolled manually using a Device Enrollment Manager. 
 

I am finding this method a little troublesome and it does cause a few Application deployment errors quite frequently, as the applications are installed when the DEM is signed in. There’s no ‘Pre provisioning’ like there is with autopilot.

 

I’ve tested Autopilot, pre provisioning/white glove and a domain join profile and got it working well. 

The only issue is that the device won’t enroll into Intune until the first user signs in and completes the ‘User flow’, shown on this guide https://learn.microsoft.com/en-us/autopilot/tutorial/pre-provisioning/hybrid-azure-ad-join-user-flow

 

Ideally, I’d like our IT Technicians to complete the technician flow and user flow element so that the device can be handed to the user ready to go.

How can we achieve this so that our techs enroll the devices, avoiding the 15 device enrollment limit?

 

thanks in advance 😀

 

 

[bicky]

We have been running Intune since 2018 and this is how we do it here.

We export hardware hash from all devices to csv file, then import it to Autopilot. Staff & students has separate group tag in csv. 

Deployment profile gets applied based on group tag.

Devices added to the Staff-Devices or Student-Devices group based on group tag via dynamic membership rules.

Device config, WiFi details, remediation scripts, app deployment, Windows updates, firewall/AV rules applies to the above two groups.

 

We then reset the old devices and hand it to the staff/students who then logon with their school credentials.

New devices are handed out once hardware hash has been imported to Autopilot.

 

 

 

 

[PotNoodleTech]

10 minutes ago, bicky said:

We have been running Intune since 2018 and this is how we do it here.

We export hardware hash from all devices to csv file, then import it to Autopilot. Staff & students has separate group tag in csv. 

Deployment profile gets applied based on group tag.

Devices added to the Staff-Devices or Student-Devices group based on group tag via dynamic membership rules.

Device config, WiFi details, remediation scripts, app deployment, Windows updates, firewall/AV rules applies to the above two groups.

 

We then reset the old devices and hand it to the staff/students who then logon with their school credentials.

New devices are handed out once hardware hash has been imported to Autopilot.

 

 

 

 

Hi just learning about this now - all new to me.  The hashes sounds like a pain the the behind - have you automated that somehow so it outputs all the PCs into one CSV?  Manually doing it on 500 pcs sounds nasty.

Edited June 13, 2025 by PotNoodleTech

[bicky]

If the devices are on domain then you can run following as startup script to get the hardware hash. Then use excel to merge all csv into one.

 

Install-Script Get-WindowsAutoPilotInfo -Force  
Get-WindowsAutoPilotInfo -OutputFile "\\network_share\$env:computername-hash.csv"  

 

 

[Erasure]

3 hours ago, bicky said:

We have been running Intune since 2018 and this is how we do it here.

We export hardware hash from all devices to csv file, then import it to Autopilot. Staff & students has separate group tag in csv. 

Deployment profile gets applied based on group tag.

Devices added to the Staff-Devices or Student-Devices group based on group tag via dynamic membership rules.

Device config, WiFi details, remediation scripts, app deployment, Windows updates, firewall/AV rules applies to the above two groups.

 

We then reset the old devices and hand it to the staff/students who then logon with their school credentials.

New devices are handed out once hardware hash has been imported to Autopilot.

 

 

 

 

thank you very much for this. I assume your staff and pupils are the ones who then complete the enrollment into Intune?

 

have you set up your Intune enrollment portal so that All users can enroll device under Enrollment > Automatic Enrollment > MDM user scope?

 

many thanks

[PotNoodleTech]

3 hours ago, bicky said:

If the devices are on domain then you can run following as startup script to get the hardware hash. Then use excel to merge all csv into one.

 

Install-Script Get-WindowsAutoPilotInfo -Force  
Get-WindowsAutoPilotInfo -OutputFile "\\network_share\$env:computername-hash.csv"  

 

 

Lovely that's awesome - cheers!!!

[bicky]

On 13/06/2025 at 12:16, Erasure said:

thank you very much for this. I assume your staff and pupils are the ones who then complete the enrollment into Intune?

 

have you set up your Intune enrollment portal so that All users can enroll device under Enrollment > Automatic Enrollment > MDM user scope?

 

many thanks

 

 

[DavR]

On 12/06/2025 at 18:38, Erasure said:

Ideally, I’d like our IT Technicians to complete the technician flow and user flow element so that the device can be handed to the user ready to go.

How can we achieve this so that our techs enroll the devices, avoiding the 15 device enrollment limit?

 

We're doing this by using the Device Enrolment Manager account in Intune to enrol the device. This means all of the install stuff happens during the DEM login, and then when that's completed, it's ready for a regular user. You may want to change or remove the primary user in Intune, but that's it. 

 

You may have to change restrictions on Entra-join numbers, but look at the reference page linked above. In practice I think each DEM has something like a 1000 device limit.

 

Edit - just realised that you're trying to do this with Entra hybrid devices. Any reason to try and use hybrid join with Intune rather than go pure Entra join?