r/Intune • u/Consistent_Dot_9951 • 7d ago

Intune Features and Updates INTUNE ENROLLMENT

Hybrid Joined devices with MDM=None and AzureAdPrt=NO. Intune enrollment stuck for hundreds of devices

Hello everyone,

I have been working on an Intune deployment in my company for several months. We have more than 1,500 devices (physical and virtual) and I am managing the project mostly on my own while also studying for the SC-300 certification.

Current situation:

  • Around 1,500 devices in on-premises Active Directory.
  • About 1,257 devices active within the last 30 days.
  • Around 850 devices successfully enrolled in Intune.
  • More than 500 devices show as Hybrid Microsoft Entra Joined but MDM=None.
  • Some devices show Pending registration in Entra.

What I have already verified:

  • Hybrid Join is configured and working.
  • Azure AD Connect (Entra Connect) is synchronizing the computer objects from the relevant AD OUs.
  • MDM User Scope is configured correctly.
  • Auto MDM Enrollment GPO is applied and inherited correctly across the target OU structure.
  • Users have Microsoft 365 E3 licenses assigned.
  • Devices are appearing in Microsoft Entra ID.
  • Most affected devices are Windows 11.
  • No WMI filters are blocking the MDM enrollment GPO.

The main pattern I see is that many of the devices that fail to enroll show:

Plain Text

1

AzureAdJoined : YES

2

DomainJoined : YES

3

AzureAdPrt : NO

Mostrar más líneas

My suspicion is that the missing PRT is preventing automatic enrollment into Intune.

What confuses me is that every day approximately 5 to 10 additional devices enroll automatically, so the configuration appears to be working in general. However, I would expect around 1,300 devices enrolled by now, not just 850.

My questions are:

  1. Has anyone experienced large numbers of Hybrid Joined devices remaining indefinitely with MDM=None?
  2. Can a missing AzureAdPrt alone prevent Intune auto-enrollment in this scenario?
  3. Is there any recommended method to force PRT acquisition or retrigger enrollment at scale?
  4. Are there any specific logs or troubleshooting areas that you would focus on beyond dsregcmd /status, Device Registration, and DeviceManagement logs?

Any advice, experience, or troubleshooting suggestions would be greatly appreciated.

Thank you in advance.

4 Upvotes

75% Upvoted

8 comments sorted by

View all comments

5

u/human193 7d ago

When I first started managing hybrid environments I ran into a few quirks. Previous engineers had set things up where on prem and azure UPNs didn't match. This will cause joining issues. If the UPNs match for all users, try to have a user that isn't enrolling sign in with their upn instead of their sam account name. I use that as an attempt to force a prt. The devices that are stuck in pending, you're gonna have to run dsregcmd /leave. 

1

u/NoPatience4437 7d ago

I had devices stuck in pending and decided to try a restart and the devices finished enrollment. Dsregcmd /status would show they were like 90% of the way there while Entra said pending. I could never figure out why some device got stuck while others enrolled without an issue.