Intune Enroll with Intune Plan 1

Hi Jaro,

The core obstacle you are facing is that automatic MDM enrollment is a feature of Entra ID Premium P1, while your current setup relies on Entra ID Free. Even though your users have Intune Plan 1 licenses, the automated handshake that links a device to Intune during a standard Entra Join is gated behind that identity license. Without the ability to modify the MDM User Scope in the portal, the system cannot automatically redirect the enrollment request to the Intune service.

To resolve this without upgrading your licenses, you must utilize manual MDM enrollment. Configuring CNAME records is the most effective way to simplify this for your users. You should create a CNAME record for enterpriseenrollment.[yourdomain.com] pointing to enterpriseenrollment.manageddevice.microsoft.com. This allows the Windows enrollment client to discover your Intune server using only a user's email address. Without this record, users would be prompted to manually enter the discovery URL, which is a common point of failure.

Instruct your users to navigate to the Access Work or School section in the Windows Settings app. They must specifically avoid the large Connect button, which defaults to an automated join process that will fail. Instead, they should select the link titled Enroll only in device management. This initiates a direct MDM enrollment that functions perfectly with Entra ID Free. Once successfully enrolled, you can verify the registration by checking the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments registry key, where a unique GUID will be generated for the Intune management session. Alternatively, installing the Microsoft Company Portal app from the Microsoft Store provides a more intuitive interface for users to achieve this same manual registration.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VP

Jaro

You are entirely correct to raise that concern. Utilizing the prior manual enrollment link strictly configures the computer in a BYOD state, leaving the Windows login screen authenticating against the local SAM database. This means users would still need a local machine account to sign into the desktop. Since your hard requirement is for users to authenticate directly against your tenant at the Windows lock screen, the machine must undergo a full Microsoft Entra Join rather than just a standalone Intune registration.

To achieve this corporate-owned state without upgrading to an Entra ID P1 license, you must split the deployment into two distinct phases. First, users must navigate to the Access Work or School settings, click the primary Connect button, and select the alternate link to Join this device to Microsoft Entra ID. This establishes the primary refresh token and configures the login screen for corporate credentials. Because your tenant lacks the auto-enrollment license, the Intune handoff will intentionally fail at this stage, which you can observe by checking the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider channel in the Event Viewer for warning event 76.

Once the device reboots and the user successfully signs into the Windows desktop utilizing their company email and password, the final step is to bridge the management gap. The user must open the Microsoft Store, download the Intune Company Portal application, and sign in. This action forces the machine to request the management certificate and merges the full MDM payload with the existing Entra Joined identity. The result is a fully managed, corporate-owned system with no reliance on local accounts.

Hope this answer brought you some useful information.

VP