How to Enrol a Windows 11 Device in Microsoft Intune

Overviewsection

Microsoft Intune is the cloud-based device management platform included with Microsoft 365 Business Premium and Enterprise E3/E5 licences. Enrolling a Windows 11 device in Intune lets you push security policies, deploy applications, enforce BitLocker encryption, and monitor compliance — all without touching the machine physically.

This guide covers the three most common enrolment methods and when to use each.

Prerequisitessection

• A Microsoft 365 licence that includes Intune (Business Premium, E3, E5, or standalone Intune Plan 1)
• Microsoft Entra joined or Microsoft Entra hybrid joined device (or willingness to join during enrolment)
• The device running Windows 11 Pro, Enterprise, or Education (Home edition does not support Intune)
• Global Admin or Intune Admin role to configure enrolment settings

Method 1: User-Driven Enrolment (Settings App)section

Best for: BYOD scenarios or small teams where users enrol their own devices.

Step 1 — Open Windows Settingssection

1. Press Win + I to open Settings
2. Navigate to Accounts > Access work or school
3. Click Connect

Step 2 — Sign in with a work accountsection

1. Enter the user's Microsoft 365 email address
2. Authenticate with MFA if prompted
3. Windows will detect the Intune enrolment URL automatically via Microsoft Entra ID

Step 3 — Accept managementsection

1. The user will see a prompt explaining what the organisation can and cannot see on their device
2. Click Connect to accept and begin enrolment
3. Wait for the "You're all set!" confirmation

Step 4 — Verify enrolmentsection

Open Settings > Accounts > Access work or school and confirm the work account shows "Connected to [Organisation] MDM".

You can also verify from the Intune admin centre at intune.microsoft.com:

1. Go to Devices > All devices
2. Search for the device name
3. Confirm the compliance state shows "Compliant" or "Pending"

Method 2: Windows Autopilotsection

Best for: New devices or reimaged machines. The device enrols automatically on first boot with no IT intervention required on-site.

Step 1 — Register the device hardware hashsection

Get the hardware hash from the device (or have your hardware vendor pre-register it):

# Run on the device (or during OOBE via Shift+F10)
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\autopilot.csv

Upload the CSV to Intune at intune.microsoft.com:

1. Go to Devices > Enrol devices > Windows enrolment > Devices
2. Click Import and upload the CSV

Alternatively, you can upload hardware hashes directly in the Intune portal without using the PowerShell script. Navigate to Devices > Enrol devices > Windows enrolment > Devices and use the Add option to upload hashes through the portal interface.

Step 2 — Create an Autopilot deployment profilesection

1. Go to Devices > Enrol devices > Deployment profiles
2. Click Create profile > Windows PC
3. Configure:
   • Deployment mode: User-Driven
   • Join type: Microsoft Entra joined
   • OOBE settings: Hide privacy settings, EULA, and account change options
4. Assign the profile to a device group

Step 3 — User powers on the devicesection

1. The device connects to the internet at OOBE
2. The user enters their Microsoft 365 credentials
3. Autopilot applies the profile, installs apps, and enforces policies automatically

Method 3: Group Policy Auto-Enrolment (Hybrid Join)section

Best for: Organisations with on-premises Active Directory that want to manage existing domain-joined devices via Intune without re-imaging.

Step 1 — Configure Microsoft Entra Connectsection

Ensure Microsoft Entra Connect (formerly Azure AD Connect) is configured for Microsoft Entra hybrid join. Devices must appear in both on-premises AD and Microsoft Entra ID. For new deployments, consider Microsoft Entra Cloud Sync as the preferred synchronisation tool.

Step 2 — Enable auto-enrolment in Entrasection

1. Go to Microsoft Entra admin center (entra.microsoft.com) > Identity > Mobility (MDM and MAM) > Microsoft Intune
2. Set MDM user scope to All or a specific group
3. Leave the default MDM and MAM URLs

Step 3 — Create a Group Policysection

1. Open Group Policy Management Console
2. Create a new GPO linked to the OU containing target devices
3. Navigate to: Computer Configuration > Administrative Templates > Windows Components > MDM
4. Enable Enable automatic MDM enrolment using default Microsoft Entra credentials
5. Set the credential type to User Credential

Step 4 — Wait for policy applicationsection

Devices will auto-enrol at the next Group Policy refresh (or force it with gpupdate /force). Enrolment may take up to 8 hours after the GPO applies.

Post-Enrolment Checklistsection

Once the device is enrolled, configure these baseline policies:

Troubleshootingsection

Next Stepssection

• Configure Conditional Access policies to block non-compliant devices from email and SharePoint
• Set up BitLocker encryption with Microsoft Entra ID key backup
• Create app protection policies for BYOD scenarios where full enrolment is not appropriate

Need help with device management?section

For a single enrolment problem, explore on-demand remote IT support. For ongoing administration of employee devices and Microsoft 365, compare our managed IT support plans.