What is MEM (Microsoft Endpoint Manager)?

Microsoft Endpoint Manager (now called Microsoft Intune) was the previous name for Microsoft’s endpoint management suite. Its unified interface helps simplify remote device and app management across diverse platforms, and its cloud-first approach makes it particularly effective in Windows-centric environments.

This article discusses Microsoft Endpoint Manager, core services, how to enroll your devices, and troubleshooting tips.

How to enroll and manage devices in Microsoft Endpoint Management or Intune

Understand what works best to optimize your process. Before selecting a method, carefully consider your goals, technical constraints, and scope.

📌 Prerequisites:

• Administrator privileges (Intune Administrator, Global Admin, or Endpoint Security Manager)
• Microsoft 365 tenant with MEM-eligible licenses (Microsoft 365 Business Premium, EMS, or Microsoft 365 E3/E5)
• Access to Microsoft Endpoint Manager Admin Center (https://www.endpoint.microsoft.com)
• Familiarity with PowerShell, GPO, registry editing, and Windows system management
• Devices with internet access to Microsoft endpoints and zero SSL inspections

📌 Recommended deployment strategies:

How to prepare a device for enrollment via Registry Editor

⚠️ Warning: Editing the registry can cause system issues. Create a backup before proceeding.

📌 Use Cases: Prepare a device for MDM/Intune enrollment by optimizing its registry keys.

1. Click Win + R, type regedit, and press Ctrl + Shift + Enter.
2. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM

1. 1. If the MDM key is missing, do the following:
      1. Right-click on the right-hand pane.
      2. Select New > Key.
      3. Name the new key “MDM”.
      4. Double-click MDM.

3. Right-click on the right-hand pane.
4. Select New > DWORD (32-bit) value.
5. Name the new value AutoEnrollMDM.
6. Double-click AutoEnrollMDM.
   1. To turn on MDM auto-enrollment, type 1 in the Value field.
   2. Press OK.
7. Right-click on the right-hand pane.
8. Select New > DWORD (32-bit) value.
9. Name the new value UseAADCredentialType.
10. Double-click UseAADCredentialType.
    1. To specify that Microsoft Entra ID (formerly Azure AD) credentials should be used, type 1 in the Value field.
    2. Press OK.
11. Restart the PC or log back in to apply your changes.

How to troubleshoot enrollment issues with Command Prompt

Diagnose Microsoft Entra ID /MEM enrollment issues and manually join devices with a lightweight command-line shell.

📌 Use Cases: Manually trigger the join process to Microsoft Entra ID in hybrid management scenarios.

1. Click Win + R, type CMD, and press Ctrl + Shift + Enter.
2. To monitor the enrollment process for Microsoft Endpoint Management, run this command:

dsregcmd /status

1. 1. Check these sections to review your device’s join status:
      1. Device state:
         1. If you see AzureAdJoined: YES, the device is joined to Entra ID.
         2. If you see DomainJoined: YES, the device is connected to a local/on-premises Active Directory (AD) server.
         3. If you see EnterpriseJoined: YES, the device is connected to a local/on-premises AD server with Workplace Join.
      2. User state: If WorkplaceJoined is displayed, the current user is signed in with an Entra ID account.
      3. MDM URLs: Displays enrollment service links when device enrollment is successful.

3. If your device still isn’t enrolled, run this command to manually start the join process for Microsoft Entra ID:

dsregcmd /join

How to manage and monitor MEM devices with PowerShell

Managing Microsoft Endpoint Manager via PowerShell is done using the official Microsoft Graph API, which lets advanced users access MEM and other Microsoft 365 services programmatically.

📌 Use Cases: Automate MEM policy audits across multiple devices.

📌Prerequisites: Active Intune license and Graph API permissions.

1. Click Win + R, type powershell, and press Ctrl + Shift + Enter.
2. Run these commands sequentially to install and connect to Microsoft Graph:

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

3. Run this command to list the devices you’ve enrolled in Microsoft Endpoint Manager:

Get-MgDeviceManagementManagedDevice

4. Run this command to manually trigger MDM enrollment.

Start-Process "C:\Windows\System32\DeviceEnroller.exe" -ArgumentList "/c /AutoEnrollMDM"

5. Run this command to monitor enrolled devices that deviate from established policies.

Get-MgDeviceManagementManagedDeviceCompliance

How to automate device enrollment via Group Policy

📌 Use Cases: A company with a hybrid infrastructure (domain-joined and Microsoft Entra ID-registered) needs to auto-enroll devices into Microsoft Intune.

📌 Prerequisites: Microsoft Entra ID and a Service Connection Point (SCP) published in AD.

1. Click Win + R, type gpedit.msc, and press Ctrl + Shift + Enter.
2. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > MDM

3. Scroll down and double-click Enable automatic MDM enrollment using default Azure AD credentials.
4. Enable the policy.
   1. Choose Device Credential for device-level enrollment.
   2. Choose User Credential to auto-enroll a user’s device when they sign into it with Entra credentials (e.g., when they add a work account to a personal device).

MEM core components

1. Microsoft Intune service– Cloud-based mobile device management (MDM) and mobile application management (MAM)
2. Configuration Manager (ConfigMgr/SCCM) – On-premises infrastructure for device management via Group Policy Objects (GPO) and AD
3. Co-Management – Combines Intune’s cloud features and ConfigMgr for hybrid management
4. Windows Autopilot – Simplifies device lifecycle management through the cloud
5. Endpoint Analytics – Cloud-native health and performance monitoring for client devices
6. Microsoft Defender for Endpoint – Built-in cybersecurity to strengthen security posture

When to use MEM for your MSP and enterprise needs

Centralized management of BYOD and corporate endpoints

MEM integrates with Azure Active Directory to monitor BYODs/company-owned endpoints for policy drift.

Automated software deployment and policy enforcement

You can deploy important work-related apps through MEM to make tools readily available at scale.

Conditional Access enforcement based on device compliance

MEM works with Azure AD Conditional Access to selectively screen devices for policy compliance before allowing access to your organization’s resources.

App protection policies (APP) for data loss prevention on mobile devices

Managed work apps and common user features (e.g., copy-paste) can be further managed to ensure your company data stays secure 24/7.

Self-service device provisioning through Autopilot

Conveniently provision devices when they are booted up for the first time to make onboarding faster than ever.

Policy-driven BitLocker and Defender enforcement

Windows-owned drive encryption features are also deployable through MEM to suit your policy’s security needs.

⚠️ Things to look out for

Important considerations for Microsoft Endpoint Manager

Evaluate Microsoft Intune’s most important features to optimize preexisting support systems for fast enrollments and centralized control.

Co-management

Microsoft Endpoint Manager supports co-management, which empowers your enterprise to simultaneously manage devices with both on-site Configuration Manager and cloud-based Intune solutions.

According to Microsoft Learn, this solution can also jumpstart your migration to the cloud, easing the load on physical servers.

Policy sets

Intune enables IT experts to create deployable policy blueprints and configuration bundles that easily allow you to repeatedly onboard users and devices from numerous departments. Leverage this feature in your provisioning efforts.

Security baselines

MEM comes with pre-configured, CIS-like security settings vetted by Microsoft’s security teams, offering additional cyber safety. Discern how they mesh with your organization’s endpoint protection policies for total cohesion.

Reporting

Endpoint Analytics and Graph API act as supplementary audit services under Microsoft Endpoint Manager. Consider their performance monitoring features to make your compliance reports comprehensive.

Troubleshooting Microsoft Endpoint Manager or Intune

MEM not detecting devices

A device has to be licensed and joined to Entra ID to be detected by MEM. If Microsoft Endpoint Manager can’t detect any of your endpoints, head to the Microsoft 365 admin center to check their licenses and verify their AD join status by running dsregcmd /status.

Intune enrollment fails

Blocked Intune enrollments are typically caused by conflicting registry settings and/or a bad Service Connection Point (SCP) in hybrid environments. Verify your SCP configuration in Active Directory and review the relevant keys under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM

Endpoint Analytics missing

If Endpoint Analytics isn’t being displayed, turn on Endpoint Analytics data collection in the MEM admin center and check if the device runs a supported OS version. For accuracy and compatibility, Endpoint Analytics relies on specific telemetry services available in modern Windows versions.

Policy not applying

If a device isn’t adapting to your policies, inspect its compliance status via Microsoft Graph PowerShell cmdlets (e.g., Connect-MgGraph -Scopes “DeviceManagementConfiguration.Read.All”

Get-MgDeviceManagementConfigurationPolicyAssignment).

If that doesn’t work, open the Intune admin center and do the following:

1. Navigate to Troubleshooting + support > Troubleshoot.
2. Select the affected user.
3. Review device health, assigned policies, and compliance status.

NinjaOne services can optimize Microsoft endpoint management

NinjaOne enhances the Microsoft Endpoint Manager experience by providing valuable insight into endpoints outside of MEM’s scope – on Windows, Linux, iOS, iPadOS, Android, and macOS.

NinjaOne RMM also automates script-based configurations to simplify MEM enrollment for a faster, hands-free approach.

Whether it’s proactive drift detection or report creation for enrolled and non-enrolled devices, supplementing your IT toolkit with NinjaOne’s flexible solutions facilitates Microsoft endpoint management across your digital workspace.

Enhance Microsoft Endpoint Manager with automated solutions

Microsoft Endpoint Manager gives you the reins to configure, monitor, and secure enrolled devices in your network. However, the methods used can be risky, so exercise caution, test often, and always prepare a backup.

With that in mind, system admins can also automate the hardest aspects of MEM setups with modern endpoint solutions that drive employee productivity from a single pane of glass.

Related topics:

• Choosing the Right Software Deployment Tool: Intune vs. NinjaOne – A User’s Perspective
• Intune vs SCCM: A Comparison of Microsoft Solutions
• 10 Best Software Deployment Tools for IT Professionals in 2025