Intune Enrollment Methods: BYOD, Corporate

Microsoft Intune is a cloud-based Mobile Device Management (MDM) and Mobile Application Management (MAM) service. Enrollment is the process of registering a device with Intune so that it can receive management policies, configuration profiles, and compliance rules. The ownership type — BYOD (Bring Your Own Device) or Corporate — determines the level of control Intune can exert over the device. BYOD devices are user-owned; the organization manages only specific aspects like apps and data via App Protection Policies (APP) without full device control. Corporate devices are organization-owned; Intune can manage the entire device, enforce full compliance, and even wipe the device entirely.

When a user enrolls a device, the following steps occur at the protocol level:

While Intune is primarily managed via the Azure portal, PowerShell and Graph API are used for automation.

PowerShell (Microsoft Graph):

# Get all enrolled devices
Get-MgDeviceManagementManagedDevice

# Get device by ID
Get-MgDeviceManagementManagedDevice -ManagedDeviceId "12345"

# Get enrollment configurations
Get-MgDeviceManagementDeviceEnrollmentConfiguration

Graph API:

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices
GET https://graph.microsoft.com/v1.0/deviceManagement/deviceEnrollmentConfigurations

Azure Portal Verification: - Navigate to Microsoft Intune > Devices > All devices. Each device shows ownership (Corporate or Personal). - Enrollment status can be: Enrolled, Pending, Failed, or Not Contacted.

BYOD enrollment is initiated by the user, typically through the Company Portal app (for iOS/Android) or Settings app (for Windows). The user signs in with their work account, and the device is registered as a personal device. Intune applies only the policies that are targeted to personal devices, such as compliance policies that check encryption and jailbreak status, and app protection policies that control data sharing. The organization cannot wipe the entire device remotely; only company data can be selectively wiped.

Corporate enrollment is often automated using: - Apple Automated Device Enrollment (ADE): Devices are purchased via Apple Business Manager (ABM) and assigned to an Intune enrollment profile. When the device is turned on, it contacts Apple's activation servers, which redirect it to Intune. The device enrolls automatically without user intervention (userless) or with user affinity. - Windows Autopilot: Similar to ADE, devices are registered with Autopilot. During OOBE, the device downloads an Autopilot profile from Intune, which specifies settings like skip privacy settings, assign device name, and automatically enroll. - Android Enterprise: Corporate-owned devices can be enrolled via Zero Touch Enrollment (purchased from Google-approved resellers) or via NFC/QR code enrollment for dedicated devices. - Device Enrollment Manager (DEM): A special account that can enroll multiple corporate devices (up to 1,000 per DEM account). This is used for kiosks or shared devices.

A multinational corporation purchases 5,000 Dell laptops directly from the manufacturer with Windows Autopilot registration. The IT team registers the devices in Intune by uploading the hardware hashes from the reseller. They create a single Autopilot deployment profile that assigns a naming convention like 'CORP-%RAND:5%' (e.g., CORP-A3F2B), skips Cortana and privacy settings, and automatically enrolls the device into Intune. The profile also enables Azure AD join. When employees receive the laptops and connect to the internet, the OOBE automatically applies the profile. The device joins Azure AD, enrolls in Intune, and receives compliance policies (BitLocker, Windows Defender) and configuration profiles (Wi-Fi, VPN). The IT team monitors enrollment success via the Intune dashboard. Common issues: devices that were not registered with Autopilot show a standard OOBE; the fix is to re-register the hardware hash. This scenario is typical for corporate-owned Windows devices.

A hospital allows nurses to use their personal iPhones to access patient records via a secure app. The hospital uses Intune with App Protection Policies (APP) and does not enroll the devices (MAM-WE). However, they also need to enforce that devices have a passcode and are not jailbroken. They create a compliance policy for iOS personal devices and require enrollment. Nurses enroll via Company Portal. The hospital sets enrollment restrictions to allow only personally owned iOS devices with iOS 15+. A Conditional Access policy requires compliant devices to access the medical records app. If a nurse's phone is jailbroken, it becomes non-compliant and access is blocked. The hospital can selectively wipe corporate data from the device but cannot wipe the entire phone. This is a common BYOD scenario where partial management is key.

A school district deploys 200 iPads for student use. These are corporate-owned devices enrolled via Apple ADE with a device enrollment profile that has no user affinity (shared device mode). Students sign in with a temporary PIN to access apps. The devices are configured with a kiosk profile that restricts them to a single educational app. Intune manages the devices fully, including app updates and configuration. The school uses a Device Enrollment Manager (DEM) account to enroll additional devices manually when needed. The key challenge is managing shared devices without user-specific policies; all policies apply to the device itself.