Intune Auto Enrollment with Windows Group Policy

[@Doctair]

Thanks for this great video. You mention you need windows 10 or 11 specific ADMX Templates but its no longer the case. Per Microsoft, as of 21/07/23, You can now use the new Windows 11 ADMX files (download from Microsoft Download Center) to maintain Windows 11 and Windows 10 clients. Hope that helps others troubling shooting the gpo deployment.

[@borg52637]

Thanks, following this video tutorial and got enrollment right the first time.

[@papajohnscookie]

Great walkthrough, thank you very much

[@adamtyler4483]

Hi Travis, I think you wanted to remove the "Authenticated Users" group from the GPO security filtering list? After adding the group "MDMDevices".

[@RP-fv7bd]

I thought so as well. Or maybe just remove the ability for Auth Users to 'Apply Group Policy'...... Or just link to a lower OU instead of the whole domain if unsure.

[@James-sc1lz]

agreed otherwise it applies to all

[@cjmorley]

I wondered this too! Can the author please clarify?

[@swill369]

Noticed this too and went looking to see if someone had commented already. Authenticated Users includes all AD objects that authenticate against the domain, so leaving that in security filtering and linking the GPO to the root of the domain will apply the policy to all Computer Objects in the domain.

[@mohammedafeef7301]

Great explanation, thank you for your effort...keep up the good work.

[@themsrshow2186]

@Travis roberts I'm stuck at the step, which is @10:03 restarted the device, havent logged in with the user credentials that has Business premium license but I dont see that device in all devices

[@agyergorcs2498]

As I know in a Hybrid environment with GPO enrollment the MDM user scope is not relevant. The MDM user scope typically comes into play when you are using a pure MDM solution for device management. In this case I would only add admins to the MDM user scope so that users can't add devices as a corporate device and all regular users to the MAM user scope. Correct me if it's wrong.

[@professor3095]

Thats the video iam looking for. Thank you very much!

[@mikefarhat6461]

You are awesome , if you can make a vlog enrolling already enrolled AAD devices to intune , Thanks

[@nestorcartaya694]

Can you show a video of a scenario where you would need to use the App ID?

[@tbits01]

This guy is awesome!!! Thanks Travis!!! Does Azure AD Connect need to be configured for Hybrid Domain Join for AD domain joined devices? This is a great demo!!!

[@Ciraltos]

Yes, Azure AD Connect sync has to sync the devices to Azure AD.

[@DaysofIresh]

Hi Travis, I still not able to login with AAD User, as it says the username or password is incorrect.

[@Catonkey1]

So if the device is domain joined already, the user's log in with their AD account. If we enroll the devices into Intune via this method, will this then make them sign into the computers with their Entra ID account/365 account? Or does the computer need to go through the whole Autopilot stuff for that to happen?

[@sohandy79]

you mentioned a difference with win 11 and 10 in realtion to GPO and auto enroll for intune. What do i need to do here, have both OS's in our network?

[@Ciraltos]

Check the links in the comments. That will point you in the right direction.

[@sohandy79]

@@Ciraltos Sorry Travis didnt cop the comments, Ta

[@Peacefornations]

Hello Travis, You do great videos!! I have a question. I have same configuration as you did, but in some of my computers i dont see the Task under EnterpriseMgmt. And the computer remain hybrid Join and dont add to Intune...Any suggestions? Thanks 😁

[@HeathenPrim3]

I'm seeing this as well, any update?

[@AvatarWil1]

This is so helpful. I'm sure in my hybrid environment the way it enrolls via GPO is nearly the same. As a learning and relatively new admin for M365: If we use conditional access to have everyone require MFA and be hybrid joined to be able to login and use cloud apps, and if we have a machine that has fallen off from Intune (max 270 days?), is there a way to bypass MFA requirement to re-enroll/re-register the device? Not sure if that's even a valid question or i'm getting confused. I also want to know if the MDM certificate in Certificate manageer even factors into the above question at all either.

[@JamesEtc3417]

Is there a reason you use users in the Intune group? I’d always been told to use devices, as it will detect the currently logged in user anyway. Speed edit: but thank you for this video! Clean and to the point.

[@DanielSzarszewski]

Not working :/

[@FirasHakeem-u9f]

Thank you so much :)

[@Ciraltos]

You're welcome!

[@runmadhu2161]

Azure AD is better than Entra ID