Exam objective 1.3 — Implement device enrollment — is the gateway to every other endpoint management task in Microsoft 365. Before you can secure a device, push an app, or wipe lost data, you have to get that device enrolled into Intune. For the MD-102 exam, if you do not understand which enrollment method works for which platform (Windows, iOS, Android, macOS), you will fail the multiple-choice questions on this domain.
Jump to a section
A simple way to picture Enrolling Devices with Microsoft Intune
Meet Priya, the front desk manager at a busy city hotel. Each morning, a new group of guests arrives. Priya’s job is to give each guest a key card that only unlocks the floor, room, and facilities they are allowed to use — the gym, the business centre, the pool. She does not hand out a master key that opens every door, because that would be a security disaster. Instead, she uses a computer system that programs each key card with exactly the right permissions. When a guest checks out, Priya deactivates the key card remotely. The guest cannot re-enter their room even if they kept the plastic card.
Now imagine the hotel is your company, and each guest is a phone, laptop, or tablet that an employee needs to use for work. Microsoft Intune is Priya’s computer system. It ‘programs’ each device with a set of rules — which apps are allowed, whether the camera can be used, whether the device must have a screen lock. This process is called enrollment. Once a device is enrolled, Intune can remotely remove company data from it if the employee leaves or the device is lost, just like Priya deactivating a key card. The device becomes a guest that follows the house rules, no matter where it is in the world.
Device enrollment is the process of registering a phone, tablet, laptop, or desktop computer with Microsoft Intune so that the organisation can manage it. Think of enrollment as a one-time handshake between the device and the cloud service. Once that handshake is complete, Intune can send policies, install apps, and enforce security settings on that device.
Before Intune existed, IT teams managed devices using on-premises tools like Group Policy and System Center Configuration Manager (SCCM). Those tools required the device to be connected to the company network or a VPN. If an employee worked from a coffee shop, the IT team had no way to enforce a new security policy until the device connected to the office network again. That gap was a huge risk. Intune solves this by managing devices over the internet, from anywhere, as long as the device has an internet connection.
Intune uses Microsoft Entra ID (formerly Azure Active Directory) as its identity backbone. Microsoft Entra ID is the cloud-based directory that stores user accounts, groups, and device identities. When a device enrolls, it registers itself in Microsoft Entra ID, creating a device object. This device object is what Intune sees and applies policies to. Every device that enrolls must either be joined or registered to Microsoft Entra ID.
There are several enrollment methods, and the right one depends on who owns the device and which operating system it runs. - Corporate-owned devices are fully owned by the organisation. IT chooses the enrollment method and often pre-configures the device before giving it to the employee. - Bring Your Own Device (BYOD) devices are personally owned by the employee. The employee initiates enrollment themselves, and Intune manages only the corporate data and apps on that device, not the entire device.
For Windows devices, the primary enrollment methods are:
Microsoft Entra ID join: The device is joined directly to Microsoft Entra ID, making it a cloud-domain-joined device. This is the modern replacement for joining a computer to an on-premises Active Directory domain. Users sign in with their work account.
Microsoft Entra hybrid join: The device is joined to both an on-premises Active Directory and Microsoft Entra ID. This is a transitional method used when the organisation still has on-premises servers.
Automatic enrollment via Group Policy: Old Windows devices that are already domain-joined can be configured to auto-enroll into Intune when a user signs in.
For iOS and iPadOS devices, the methods include:
Apple Automated Device Enrollment (formerly DEP): For corporate-owned iPhones and iPads bought directly from Apple or an authorised reseller. The device is pre-assigned to the organisation, and when the user turns it on for the first time, it automatically enrolls into Intune without the user needing to install a profile.
Apple Configurator: Used to manually prepare a corporate-owned device that was not bought through Apple’s business programme.
User-initiated enrollment: The employee downloads the Company Portal app from the App Store and signs in to enroll their personal device.
For Android devices, the methods are:
Android Enterprise fully managed: For corporate-owned devices. The entire device is managed by the organisation, similar to a company phone.
Android Enterprise work profile: For personally owned devices (BYOD). The organisation manages a separate work profile on the device, keeping personal apps and data private.
Android Enterprise dedicated devices: For kiosk-style devices like digital signage or checkout terminals.
For macOS devices, the methods include:
Apple Automated Device Enrollment: Similar to iOS, for corporate Macs.
User-initiated enrollment: The employee installs the Company Portal app and signs in with their work credentials.
Each enrollment method has a specific setup flow and a different user experience. The MD-102 exam expects you to know which method to use for a given scenario. For example, if a company buys 50 iPhones from Apple and wants them ready for use as soon as they are unboxed, the answer is Apple Automated Device Enrollment. If an employee wants to check work email on their personal Android phone without letting IT see their photos, the answer is Android Enterprise work profile.
Enrollment is not a one-time event that finishes and becomes irrelevant. Intune continuously checks that the device still meets the organisation’s compliance policies. If a user jailbreaks their iPhone or installs an untrusted app, Intune can mark the device as non-compliant and block access to company resources like email and SharePoint. This ongoing enforcement is what makes endpoint management powerful.
Prerequisites Check
Before enrolling any device, the IT administrator must ensure the organisation has the required licences (Microsoft 365 E3 or E5, or Intune standalone licence), a Microsoft Entra ID tenant, and the correct Apple Business Manager account (for Apple devices) or Android Enterprise binding (for Android). Without these, enrollment will fail.
Create Enrollment Profile
The administrator creates an enrollment profile in the Intune console for each platform. This profile defines settings such as whether the device is corporate or BYOD, which terms of use to display, and whether the user must set a PIN. The profile is assigned to user groups or device groups.
User Initiates Enrollment
On a BYOD device, the user installs the Company Portal app and signs in with their work email and password. On a corporate device (e.g., new iPhone), the device automatically detects the organisation’s enrollment profile during initial setup and prompts the user to sign in.
Device Registers with Microsoft Entra ID
Once the user signs in, the device registers itself with Microsoft Entra ID, creating a unique device identity. Intune then receives a notification that a new device is available for management. This step is invisible to the user but critical for policy delivery.
Policy and App Deployment
After enrollment, Intune pushes the assigned compliance policies, configuration profiles, and required apps to the device. The device may also receive certificates for access to corporate resources like VPN and Wi-Fi. The user can now use the device for work, and Intune enforces the rules set by the administrator.
Sarah is the IT administrator for a medium-sized logistics company with 200 employees. The company is growing and has decided to shift from on-premises management to cloud-only management with Microsoft Intune. The CEO wants all corporate laptops and employee phones to be managed within the next 30 days.
Sarah starts with the Windows laptops that are already in use. These laptops are joined to the on-premises Active Directory domain, so she enables automatic enrollment through a Group Policy. She creates a GPO in the on-premises server that tells each laptop to auto-enroll into Intune when the user signs in. Over the next two days, 150 laptops show up in the Intune console automatically.
Next, she orders 30 new Windows laptops for new hires. Instead of the old process of imaging each laptop manually, she uses Windows Autopilot. She uploads the hardware IDs of the new laptops to Intune, creates a deployment profile, and ships the sealed boxes directly to the employees. When each employee unboxes the laptop, connects to Wi-Fi, and signs in with their work email, the laptop automatically joins Microsoft Entra ID, enrolls into Intune, and installs the required apps — all without Sarah touching the device.
For the sales team, she needs to manage their personal iPhones. She directs the sales team to install the Microsoft Intune Company Portal app from the App Store. The employees sign in with their work account and follow the prompts to allow management of the device. Because these are BYOD devices, Sarah configures an iOS enrollment profile that only manages corporate apps and email, not personal photos or messages.
The warehouse uses shared Android tablets for inventory scanning. Sarah configures these as Android Enterprise dedicated devices using a kiosk mode. She locks the tablet so that only the inventory scanning app can run. The tablets enroll automatically when powered on for the first time.
Finally, the CEO gets a new MacBook. Sarah uses Apple Business Manager to assign the MacBook to the organisation. The CEO signs in, and the MacBook enrolls into Intune automatically, receiving the company’s VPN and Wi-Fi settings without any manual configuration.
Throughout this process, Sarah uses the Intune console to:
Create enrollment profiles for each platform (Windows, iOS, Android, macOS)
Assign device categories (corporate, personal, shared)
Set compliance policies (required encryption, minimum OS version)
Monitor enrollment success in the Device Enrollment dashboard
Troubleshoot devices that fail enrollment by checking logs in Microsoft Entra ID
The MD-102 exam tests device enrollment heavily, typically with 8 to 12 questions across the entire exam. Most of these are scenario-based multiple-choice questions. You will be given a description of a company’s environment and asked which enrollment method to use. The exam focuses on five key areas:
Choosing between Microsoft Entra ID join, Microsoft Entra hybrid join, and automatic enrollment for Windows devices.
Distinguishing between Apple Automated Device Enrollment (ADE) and Apple Configurator for iOS and iPadOS.
Selecting the correct Android enrollment method for corporate-owned, personally owned, and shared devices.
Knowing the prerequisites for each enrollment method (e.g., need an Apple Business Manager account for ADE, need a Microsoft Entra ID P1 licence for automatic Windows enrollment).
Understanding the difference between user-affinity and device-affinity enrollment.
Common traps the exam sets:
They will ask about enrolling a device that is already in use. If the device is already joined to an on-premises domain, the correct answer is usually automatic enrollment via Group Policy, not a fresh Microsoft Entra ID join.
They will describe a BYOD scenario and present an option to enroll the entire device as fully managed. That is wrong for BYOD; the correct option is work profile (Android) or user-initiated enrollment (iOS).
They will mention “Apple Configurator” as the answer for a scenario where the company uses Apple Business Manager. Apple Configurator is for devices that are NOT in Apple Business Manager. If the company has an ABM account and the device is bought through it, ADE is the answer.
They will test the difference between “Enrollment restrictions” and “Compliance policies”. Enrollment restrictions control which devices are allowed to enroll at all (e.g., block personal Android devices). Compliance policies control what a device must do after it is enrolled (e.g., require a PIN).
Key definitions to memorise:
Company Portal: The app users install to enroll BYOD devices and access company resources.
Enrollment profile: A configuration that defines how a device enrolls (e.g., whether the user must set a PIN, which terms of use to show).
Device enrollment manager (DEM): A special account that can enroll many devices at once, often used for shared or kiosk devices.
Apple Business Manager (ABM): Apple’s portal for managing corporate-owned devices.
Android Enterprise: Google’s management framework for Android devices, required for Intune management.
The exam also tests the enrolment flow: after enrollment, the device receives a certificate that it uses to communicate with Intune. This certificate is issued by Microsoft Entra ID and is renewed automatically. If the certificate expires, the device becomes unmanaged until it re-enrolls or the certificate is refreshed.
Device enrollment is the process of registering a device with Intune so the organisation can apply policies and manage it from the cloud.
Microsoft Entra ID is the identity backbone for Intune — every enrolled device creates a device object in Microsoft Entra ID.
Windows devices can use Microsoft Entra ID join (cloud-native) or Microsoft Entra hybrid join (transitional), not traditional domain join.
Apple Automated Device Enrollment is for corporate iOS/iPadOS/macOS devices bought through Apple Business Manager, not for personal devices.
Android Enterprise work profile is the correct method for BYOD Android devices because it separates corporate data from personal data.
Enrollment restrictions and compliance policies are different: restrictions control which devices can enroll at all, compliance policies enforce what devices must do after enrollment.
These come up on the exam all the time. Here's how to tell them apart.
Microsoft Entra ID Join (Windows)
Device is joined only to Microsoft Entra ID, no on-premises dependency
User signs in with cloud-only credentials
Best for new devices and cloud-first organisations
Microsoft Entra Hybrid Join (Windows)
Device is joined to both on-premises Active Directory and Microsoft Entra ID
Requires network connectivity to on-premises domain controller
Used for existing devices that still need on-premises resources
Apple Automated Device Enrollment (ADE)
Automated, no user interaction during initial setup
Requires device to be purchased through Apple Business Manager
Profile is pushed over the internet from Apple's servers
Apple Configurator
Manual process using a Mac app and USB cable
Used for devices not in Apple Business Manager
Profile is installed locally, not pushed from cloud
Android Enterprise Fully Managed
Entire device is managed by the organisation
IT can manage all apps and settings on the device
Used for corporate-owned devices only
Android Enterprise Work Profile
Only a separate work profile is managed, personal apps are private
IT cannot see or manage personal apps or data
Used for BYOD (personally owned) devices
Enrollment Restrictions
Control which devices are allowed to enroll at all
Applied before enrollment is completed
Can block personal devices or specific platforms entirely
Compliance Policies
Define what a device must do after it is already enrolled
Applied after enrollment, checked regularly
Include requirements like PIN length, encryption, or OS version
Mistake
You can manage any device by just installing the Company Portal app, even if it is not enrolled.
Correct
Installing the Company Portal app alone does not manage the device. The user must complete the enrollment process through the app, which includes signing in with a work account and granting permissions for Intune to manage the device.
Beginners see the Company Portal app as a magic tool and think installing it is equivalent to managing the device. In reality, enrollment is a separate step that creates a device identity in Microsoft Entra ID.
Mistake
Corporate-owned Windows devices must always use Microsoft Entra hybrid join.
Correct
Corporate-owned Windows devices can use Microsoft Entra ID join directly. Hybrid join is only needed if the organisation still relies on on-premises Active Directory and Group Policy.
Many IT pros come from an on-premises background and assume domain join is mandatory. The exam pushes cloud-native thinking, so Microsoft Entra ID join is preferred for new devices.
Mistake
Enrolling a device gives IT full access to the user's personal data, including photos and messages.
Correct
In BYOD scenarios, Intune only manages corporate data within a managed container (work profile on Android, managed app configuration on iOS). IT cannot see personal photos, messages, or browsing history.
Users fear privacy invasion, and this misconception spreads because people confuse 'managed device' with 'monitored device'. Intune is not spyware; it enforces policies on apps and data, not on the user's personal space.
Mistake
Apple Automated Device Enrollment requires the user to manually install a profile from a website.
Correct
Apple Automated Device Enrollment works during the initial device setup. The device contacts Apple's servers, recognises it belongs to the organisation, and downloads the management profile automatically — no user action beyond signing in with their work account.
Beginners confuse ADE with older methods like Apple Configurator, which do require manual profile installation. The exam loves testing this distinction.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. If you are enrolling a personal phone as a BYOD device, Intune creates a separate managed container (work profile on Android, managed apps on iOS). Your personal apps, photos, and data remain private and are not touched by the company.
When a device is removed from Intune (either by the administrator or by the user unenrolling through the Company Portal), the management profile is removed, and all corporate data — such as company email and managed apps — is deleted from the device. Personal data remains.
No. Every device enrolled in Intune must be associated with a user account in Microsoft Entra ID. The user signs in with their work account during enrollment. Shared or kiosk devices use a device enrollment manager account, which is still an account in Microsoft Entra ID.
Apple Automated Device Enrollment is a cloud-based service that automatically enrolls devices purchased through Apple Business Manager. Apple Configurator is a Mac app used to manually prepare devices that were not purchased through Apple Business Manager by installing a management profile via USB cable.
No. Intune requires Android device management to use the Android Enterprise framework, which depends on Google Play Services. Devices like Amazon Fire tablets or Chinese phones without Google apps cannot be enrolled as managed Android devices in Intune.
You enroll it the same way as any other device. If it is a corporate device, you use the appropriate method (e.g., Apple Configurator for iOS if it is not in Apple Business Manager, or manual setup for Windows). For BYOD, you install the Company Portal app and sign in.
You've finished Enrolling Devices with Microsoft Intune. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?