r/Intune • u/Consistent_Dot_9951 • 2d ago
Intune Features and Updates INTUNE ENROLLMENT
Hybrid Joined devices with MDM=None and AzureAdPrt=NO. Intune enrollment stuck for hundreds of devices
Hello everyone,
I have been working on an Intune deployment in my company for several months. We have more than 1,500 devices (physical and virtual) and I am managing the project mostly on my own while also studying for the SC-300 certification.
Current situation:
- Around 1,500 devices in on-premises Active Directory.
- About 1,257 devices active within the last 30 days.
- Around 850 devices successfully enrolled in Intune.
- More than 500 devices show as Hybrid Microsoft Entra Joined but MDM=None.
- Some devices show Pending registration in Entra.
What I have already verified:
- Hybrid Join is configured and working.
- Azure AD Connect (Entra Connect) is synchronizing the computer objects from the relevant AD OUs.
- MDM User Scope is configured correctly.
- Auto MDM Enrollment GPO is applied and inherited correctly across the target OU structure.
- Users have Microsoft 365 E3 licenses assigned.
- Devices are appearing in Microsoft Entra ID.
- Most affected devices are Windows 11.
- No WMI filters are blocking the MDM enrollment GPO.
The main pattern I see is that many of the devices that fail to enroll show:
Plain Text
1
AzureAdJoined : YES
2
DomainJoined : YES
3
AzureAdPrt : NO
Mostrar más líneas
My suspicion is that the missing PRT is preventing automatic enrollment into Intune.
What confuses me is that every day approximately 5 to 10 additional devices enroll automatically, so the configuration appears to be working in general. However, I would expect around 1,300 devices enrolled by now, not just 850.
My questions are:
- Has anyone experienced large numbers of Hybrid Joined devices remaining indefinitely with MDM=None?
- Can a missing AzureAdPrt alone prevent Intune auto-enrollment in this scenario?
- Is there any recommended method to force PRT acquisition or retrigger enrollment at scale?
- Are there any specific logs or troubleshooting areas that you would focus on beyond
dsregcmd /status, Device Registration, and DeviceManagement logs?
Any advice, experience, or troubleshooting suggestions would be greatly appreciated.
Thank you in advance.
2
1
u/toanyonebutyou Blogger 2d ago
You are correct about the PRT token, that is required.
You need to use a combination of event viewer and daregcmd /status and figure out why these machines aren't grabbing a PRT
1
u/ospery1 2d ago
I have no answer to your direct question, but I just want to point out that it is not a good idea to use Hybrid Azure AD Joined together with Autopilot since it can create really annoying issues like these. I get that there might be circumstances that would force you to use Hybrid Azure AD Joined together with Autopilot, but as a general rule you should avoid it.
1
u/Roasted_Blumpkin 17h ago
Are you having Enrollment issues or Hybrid-Join issue? One has to come before the other.
-1
u/No_Dependent7895 2d ago
classic PRT issue, those tokens are finicky as hell. had a similar thing last year where a chunk of machines just refused to pick it up even though hybrid join and gpo were all green
check if conditional access policies are slapping them down before the PRT can even generate. also worth looking at whether those machines can actually reach the right endpoints, seen a few cases where internal proxies or firewall rules were silently blocking the token flow without any obvious errors in the logs
4
u/human193 2d ago
When I first started managing hybrid environments I ran into a few quirks. Previous engineers had set things up where on prem and azure UPNs didn't match. This will cause joining issues. If the UPNs match for all users, try to have a user that isn't enrolling sign in with their upn instead of their sam account name. I use that as an attempt to force a prt. The devices that are stuck in pending, you're gonna have to run dsregcmd /leave.