Intune device enrolment for Hybrid AD joined machine

Question

Intune device enrolment for Hybrid AD joined machine

Gaurav Nigota 0

Facing issues while enrolling a machine(Hybrid join) to Intune via GPO, however the machine shows the MDM URL's correctly checked through dsregcmd /status.
Still the machine is not enrolling over Intune Portal.

Checked the Hybrid join-SCP configuration, works perfectly.
What should I do or check?

Rahul Jindal 11,731 Reputation points

2026-09-07T10:07:38.76+00:00

Are the devices hybrid joined correctly and reporting in Entra ID? Have you enabled automatic enrolment in Intune? Are the users licensed? What value are you using for enrolment in GPO, user or device? Is the user PRT token active on the device? You can also check sign-in logs to see if conditional access policies are interfering with the automatic enrolment or not.
Gaurav Nigota 0 Reputation points

2026-09-07T10:21:37.95+00:00

Yes, the devices are hybrid joined and reporting in Entra ID

Automatic Enrolment enabled in Intune and user's are in scope and the user is licensed.

Value for enrolment in GPO : User credentials.

AzureAdPrt : No, but sometimes the value of it changes to Yes.

1 answer

Your answer

Rahul Jindal 11,731 Reputation points

2026-09-07T10:07:38.76+00:00

Are the devices hybrid joined correctly and reporting in Entra ID? Have you enabled automatic enrolment in Intune? Are the users licensed? What value are you using for enrolment in GPO, user or device? Is the user PRT token active on the device? You can also check sign-in logs to see if conditional access policies are interfering with the automatic enrolment or not.
Gaurav Nigota 0 Reputation points

2026-09-07T10:21:37.95+00:00

Yes, the devices are hybrid joined and reporting in Entra ID

Automatic Enrolment enabled in Intune and user's are in scope and the user is licensed.

Value for enrolment in GPO : User credentials.

AzureAdPrt : No, but sometimes the value of it changes to Yes.

Answer 1

A likely cause is the AzureAdPrt status not being consistently available. Automatic MDM enrolment using user credentials depends on the user obtaining a valid PRT. If AzureAdPrt is showing No most of the time, focus on fixing the Entra sign-in state first.

Also check:

Event Viewer -> Applications and Services Logs -> Microsoft -> Windows -> DeviceManagement-Enterprise-Diagnostics-Provider > Admin
Scheduled Task: Microsoft -> Windows -> EnterpriseMgmt for enrolment failures
dsregcmd /status and confirm AzureAdJoined = YES, DomainJoined = YES, and AzureAdPrt = YES
Entra sign-in logs for MDM enrolment failures or Conditional Access blocks
Intune enrolment restrictions and device limits

If the device never gets a stable PRT, Intune enrolment via GPO will generally not complete successfully.