Entra ID Free: what happens to already joined and Intune-enrolled PCs if I reset the MDM user scope to "None" after Intune licenses were removed?

Luigi D'Acunto 0 Reputation points
2026-10-01T12:28:07.1233333+00:00

I have a Microsoft 365 nonprofit tenant on the Microsoft Entra ID Free plan, with users on Business Basic. Previously I had higher-tier licenses (Business Premium) included in the nonprofit offer, which have now been removed.

With those licenses I joined 9 Windows PCs to Microsoft Entra ID, and they were automatically enrolled in Intune. Today, in the Entra device list they show MDM = Microsoft Intune, management = Microsoft Intune and compliant = No. Users without an Intune license can still sign in on the already-joined PCs.

A new PC cannot complete "Join this device to Microsoft Entra ID" with a new user who has no Intune license. In the sign-in log the authentication succeeds, the resource is "Microsoft Intune Enrollment" and no device registration event appears. In Entra, Mobility (MDM and WIP) shows the Intune app as enabled, with the link to reset the scopes to "None" (I have not clicked it).

I have already searched the Microsoft Learn documentation and Microsoft Q&A threads: I found that with the MDM scope set to "None" automatic enrollment is disabled for new joins, but I found no reference on what happens to devices that are already joined and enrolled, or to users without a license, when the scope is reset on an Entra ID Free tenant. If anyone can also point me to a reference in the official documentation that covers this case, I would really appreciate it.

Questions:

  1. Is the still-active automatic enrollment the cause of the failed join? Is setting the scope to "None" the fix?
  2. If I reset the scope, do the already-joined PCs stay joined to Entra? Can users, even without a license, keep signing in with the same credentials and local profiles, without data loss?
  3. What happens to the existing Intune enrollment on those devices?
  4. Without Entra ID Premium, how do I bring the non-compliant devices to an unmanaged state without re-joining them and without losing profiles? Is there a documented procedure?
  5. Is the scope reset reversible on Entra ID Free?

Thanks in advance to anyone who can help.

Microsoft Security | Intune | Enrollment
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rauh, Alexander 80 Reputation points
    2026-10-06T14:20:10.6766667+00:00

    Hello Luigi D'Acunto,

    Yes. While a user is in the MDM user scope Windows will enroll the device during the join and if that fails because of missing Intune license the join is rolled back (docs). Users outside the scope join without MDM

    Resetting it to None doesn't touch existing PCs. In my lab after taking a user out of the scope and removing the license the PC stayed joined the user kept the same profile and Intune syncs still worked.

    There is no supported way to unenroll without unjoining (docs) as of my knowledge. What worked in my lab:

    1. Create a local admin
    2. Retire the device
    3. Rejoin it with the scope of None
    4. User profile got reused so no data gets lost

    In your case I still would test it on one device first before doing it for all so you did in one time yourself.
    Keep also in mind if you have BitLocker enabled please save the recovery key first.

    If you want to set the scope back to All later on you need to have at least an Entra P1 or P2 Tenant.

    if this Answer help you please "Accept Answer" so others can find it better and also help me :)

    Best Regards

    Alex

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.