Fix: Intune Enrollment Fails with Domain User but Works with Local Admin (GPO Conflict & MDM Scope)
This post explains exactly why this happens and how to fix it cleanly using Microsoft-recommended modern management practices.
🔍 Symptoms
⚠️ What You May Experience
- Devices enroll successfully with local admin accounts but fail or partially register with domain users
- Group Policies (GPO) apply to the local admin account instead of the domain user
- Policies not working as expected — e.g. hidden drives (C:, D:), Chrome download path redirected to Z: drive
- Device not appearing correctly in Intune, or showing “Azure AD Registered” instead of “Azure AD Joined” or “Hybrid Joined”
🧠 Root Cause
Misalignment between GPO-based management and Intune (MDM)
- Missing or incorrect MDM User Scope — domain users are not allowed to auto-enroll into Intune
- GPO conflicts with MDM enrollment — traditional GPOs override MDM policies or prevent proper registration
- Device not Hybrid Azure AD Joined — devices are domain-joined but not properly registered with Microsoft Entra ID
- Enrollment method differences — local admin enrollment triggers manual enrollment, bypassing user scope issues; domain user enrollment relies on automatic MDM enrollment, which may be misconfigured
🛠️ Step-by-Step Resolution
Verify MDM User Scope in Entra ID
Ensure domain users are permitted to auto-enroll into Intune.
✅ Steps in Microsoft Entra Admin Center
- Go to Microsoft Entra Admin Center
- Navigate to: Devices → Enrollment → Automatic Enrollment
- Set MDM user scope = All (or select the required security group)
- Set MAM user scope = None (unless MAM is required)
Configure GPO for Automatic Intune Enrollment
Create or edit a Group Policy on your domain controller to trigger automatic MDM enrollment for domain users.
✅ Group Policy Path
- Open Group Policy Management on your domain controller
- Navigate to: Computer Configuration → Policies → Administrative Templates → Windows Components → MDM
- Enable: “Enable automatic MDM enrollment using default Azure AD credentials”
- Set credential type to: User Credential
💡 Why This Matters
Setting to User Credential ensures domain users (not just local admins) trigger Intune enrollment automatically when they sign in.
Validate Hybrid Azure AD Join
Run the following command on the affected device to confirm it is properly Hybrid Azure AD Joined.
dsregcmd /status
| Parameter | Expected Value |
|---|---|
AzureAdJoined |
YES |
DomainJoined |
YES |
Device State |
Hybrid Azure AD Joined |
⚠️ If AzureAdJoined = NO
The device is only domain-joined but not registered with Entra ID. Hybrid Azure AD Join must be configured via Azure AD Connect before enrollment will work for domain users.
Verify Device Registration in Entra ID
Confirm the device is visible in Entra ID with the correct join type and owner.
✅ Steps in Microsoft Entra Admin Center
- Navigate to: Devices → All Devices
- Confirm device appears as Hybrid Azure AD Joined
- Confirm Owner = domain user (not local admin)
Check Enrollment Restrictions in Intune
Verify that enrollment restrictions are not blocking domain users or the device type.
✅ Steps in Intune Admin Center
- Navigate to: Devices → Enrollment Restrictions
- Verify the device platform (Windows) is allowed
- Verify the device limit per user has not been exceeded
Ensure Intune Licensing is Assigned to Domain Users
Domain users must have an active Intune license assigned — enrollment will silently fail without one.
⚠️ Required License
Each domain user must have a Microsoft Intune license assigned — included in Microsoft 365 E3, E5, or Business Premium plans. Verify in Microsoft 365 Admin Center under Users → Active Users → Licenses.
Review and Resolve GPO vs MDM Policy Conflicts
When both GPO and Intune MDM manage the same setting, conflicts cause unpredictable behavior.
⚠️ The Core Conflict
- GPO policies affect settings at the domain/OU level
- Intune policies affect settings at the user/device level via MDM
- When both target the same setting, conflicts cause inconsistent enforcement
✅ Recommendation
- Move user-based settings (e.g. Chrome download path, drive visibility) to Intune Configuration Profiles
- Keep only essential device-level GPOs that have no Intune equivalent
- Use Group Policy Analytics in Intune to identify which GPOs can be migrated
Trigger Enrollment Manually (For Testing)
Login as the domain user and run one of the following to force re-enrollment.
Start-Process "ms-settings:workplace"
dsregcmd /leave dsregcmd /join
Validate Enrollment via Microsoft Graph PowerShell
Confirm the device is enrolled and managed by MDM — not GPO only.
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All" Get-MgDeviceManagementManagedDevice -Filter "contains(deviceName,'YourDeviceName')" | Select-Object deviceName, userPrincipalName, managementAgent
✅ Expected Result
managementAgent should show MDM — confirming the device is fully Intune-managed and not GPO-only.
💡 Best Practices & Recommendations
- Prefer Hybrid Azure AD Join + Auto Enrollment via GPO for domain-joined devices in mixed environments
- Gradually migrate GPO workloads to Intune Configuration Profiles using Group Policy Analytics
- Avoid mixing user-targeted GPO and MDM policies for the same settings on the same devices
- Use device-based policies in Intune rather than relying heavily on on-premises GPOs for modern managed devices
- Always assign the correct Intune license to domain users before attempting enrollment
✅ Key Takeaway
If enrollment works with a local admin but fails with domain users, the issue is almost always related to MDM scope, Hybrid Azure AD Join configuration, or GPO interference — not Intune itself. Fix the identity layer first, then address policy conflicts.
📚 References & Further Reading
- 🔗 Windows Device Enrollment Guide for Microsoft Intune — Microsoft Learn
- 🔗 Troubleshoot Microsoft Entra Hybrid Joined Devices — Microsoft Learn
- 🔗 ControlPolicyConflict Policy CSP (MDMWinsOverGP) — Microsoft Learn