What is MEM (Microsoft Endpoint Manager)?

Microsoft Intune (formerly Microsoft Endpoint Manager) is Microsoft’s cloud-based endpoint management suite. Its unified interface helps simplify remote device and app management across diverse platforms, and its cloud-first approach makes it particularly effective in Windows-centric environments.

This article discusses Microsoft Intune, core services, how to enroll your devices, and troubleshooting tips.

For a visual version of this guide, watch What is MEM (Microsoft Endpoint Manager)?.

How to enroll and manage devices in Microsoft Intune or Endpoint Manager

Understand what works best to optimize your process. Before selecting a method, carefully consider your goals, technical constraints, and scope.

📌 Prerequisites:

• Administrator privileges (Intune Administrator, Global Admin, or Endpoint Security Manager)
• Microsoft 365 tenant with Intune-eligible licenses (Microsoft 365 Business Premium, EMS, or Microsoft 365 E3/E5)
• Access to Microsoft Intune admin center (microsoft.com)
• Familiarity with PowerShell, GPO, registry editing, and Windows system management
• Devices with internet access to Microsoft endpoints and zero SSL inspections

📌 Recommended deployment strategies:

How to prepare a device for enrollment via Registry Editor

⚠️ Warning: Editing the registry can cause system issues. Create a backup before proceeding.

📌 Use Cases: Prepare a device for MDM/Intune enrollment by optimizing its registry keys.

1. Click Win + R, type regedit, and press Ctrl + Shift + Enter.
2. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM

1. 1. If the MDM key is missing, do the following:
      1. Right-click on the right-hand pane.
      2. Select New > Key.
      3. Name the new key “MDM”.
      4. Double-click MDM.

3. Right-click on the right-hand pane.
4. Select New > DWORD (32-bit) value.
5. Name the new value AutoEnrollMDM.
6. Double-click AutoEnrollMDM.
   1. To turn on MDM auto-enrollment, type 1 in the Value field.
   2. Press OK.
7. Right-click on the right-hand pane.
8. Select New > DWORD (32-bit) value.
9. Name the new value UseAADCredentialType.
10. Double-click UseAADCredentialType.
    1. To specify that Microsoft Entra ID (formerly Azure AD) credentials should be used, type 1 in the Value field.
    2. Press OK.
11. Restart the PC or log back in to apply your changes.

How to troubleshoot enrollment issues with Command Prompt

Diagnose Microsoft Entra ID/Intune enrollment issues and manually join devices with a lightweight command-line shell.

📌 Use Cases: Manually trigger the join process to Microsoft Entra ID in hybrid management scenarios.

1. Click Win + R, type CMD, and press Ctrl + Shift + Enter.
2. To monitor the enrollment process for Microsoft Endpoint Manager, run this command:

dsregcmd /status

1. 1. Check these sections to review your device’s join status:
      1. Device state:
         1. If you see MicrosoftEntraJoined: YES, the device is joined to Entra ID.
         2. If you see DomainJoined: YES, the device is connected to a local/on-premises Active Directory (AD) server.
         3. If you see EnterpriseJoined: YES, the device is connected to a local/on-premises AD server with Workplace Join.
      2. User state: If WorkplaceJoined is displayed, the current user is signed in with an Entra ID account.
      3. MDM URLs: Displays enrollment service links when device enrollment is successful.

3. If your device still isn’t enrolled, run this command to manually start the join process for Microsoft Entra ID:

dsregcmd /join

How to manage and monitor Intune devices with PowerShell

Managing Microsoft Intune via PowerShell is done using the official Microsoft Graph API, which lets advanced users access Intune and other Microsoft 365 services programmatically.

📌 Use Cases: Automate Intune policy audits across multiple devices.

📌Prerequisites: Active Intune license and Graph API permissions.

1. Click Win + R, type powershell, and press Ctrl + Shift + Enter.
2. Run these commands sequentially to install and connect to Microsoft Graph:

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

3. Run this command to list the devices you’ve enrolled in Microsoft Endpoint Manager:

Get-MgDeviceManagementManagedDevice

4. Run this command to manually trigger MDM enrollment.

Start-Process "C:\Windows\System32\DeviceEnroller.exe" -ArgumentList "/c /AutoEnrollMDM"

5. Run this command to monitor enrolled devices that deviate from established policies.

Get-MgDeviceManagementManagedDevice -All |

Where-Object { $_.ComplianceState -ne "compliant" } |

Select-Object DeviceName, ComplianceState

How to automate device enrollment via Group Policy

📌 Use Cases: A company with a hybrid infrastructure (domain-joined and Microsoft Entra ID-registered) needs to auto-enroll devices into Microsoft Intune.

📌 Prerequisites: Microsoft Entra ID and a Service Connection Point (SCP) published in AD.

1. Click Win + R, type gpedit.msc, and press Ctrl + Shift + Enter.
2. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > MDM

3. Scroll down and double-click Enable automatic MDM enrollment using default Azure AD credentials.
4. Enable the policy.
   1. Choose Device Credential for device-level enrollment.
   2. Choose User Credential to auto-enroll a user’s device when they sign into it with Entra credentials (e.g., when they add a work account to a personal device).

What’s new in Intune (Microsoft Endpoint Manager)

Microsoft continues to expand Intune with new features that simplify hybrid and cloud-first management:

• Enhanced Windows Autopilot diagnostics – Provides clearer error messages and faster troubleshooting during device provisioning.
• macOS and iOS management improvements – Expanded app configuration and remote actions for Apple devices.
• Settings Catalog updates – Prebuilt policies now cover Google Chrome and third-party applications without custom OMA-URI settings.
• Security enhancements – Stronger Conditional Access options and integrated Defender for Endpoint improvements.
• Firmware and driver management – New preview features allow administrators to manage updates directly from Windows Update for Business.

Intune core components

1. Co-management – Combines Intune’s cloud features and ConfigMgr for hybrid management
2. Windows Autopilot – Simplifies device lifecycle management through the cloud
3. Endpoint Analytics – Cloud-native health and performance monitoring for client devices
4. Microsoft Defender for Endpoint – Built-in cybersecurity to strengthen security posture. Newer updates also expand MEM’s reach into firmware/driver management and provide predictive update rollouts that reduce deployment failures.

When to use Intune for your MSP and enterprise needs

Centralized management of BYOD and corporate endpoints

Intune integrates with Microsoft Entra ID to monitor BYODs and company-owned endpoints for policy drift.

Automated software deployment and policy enforcement

You can deploy important work-related apps through Intune to make tools readily available at scale.

Conditional Access enforcement based on device compliance

Intune works with Entra ID Conditional Access to selectively screen devices for policy compliance before allowing access to your organization’s resources.

App protection policies (APP) for data loss prevention on mobile devices

Managed work apps and common user features (e.g., copy-paste) can be further managed to ensure your company data stays secure 24/7.

Self-service device provisioning through Autopilot

Conveniently provision devices when they are booted up for the first time to make onboarding faster.

Policy-driven BitLocker and Defender enforcement

Windows-owned drive encryption features are also deployable through Intune to suit your policy’s security needs.

⚠️ Things to look out for

Important considerations for Microsoft Intune

Evaluate Microsoft Intune’s most important features to optimize preexisting support systems for fast enrollments and centralized control.

Co-management

Microsoft Intune supports co-management, which empowers your enterprise to simultaneously manage Windows devices with both on-premises Microsoft Configuration Manager and cloud-based Intune.

According to Microsoft Learn, this solution can also jumpstart your migration to the cloud, easing the load on physical servers.

Policy sets

Intune enables IT experts to create deployable policy blueprints and configuration bundles that allow you to repeatedly onboard users and devices from numerous departments. Leverage this feature in your provisioning efforts.

Security baselines

Intune comes with pre-configured, CIS-like security settings vetted by Microsoft’s security teams, offering additional cyber safety. Discern how they mesh with your organization’s endpoint protection policies.

Reporting

Endpoint analytics and the Microsoft Graph API act as supplementary audit services under Microsoft Intune. Consider their performance monitoring features to make your compliance reports comprehensive.

Troubleshooting Microsoft Endpoint Manager or Intune

Intunenot detecting devices

A device has to be licensed and joined to Entra ID for Intune to detect it. If Microsoft Endpoint Manager can’t detect any of your endpoints, head to the Microsoft 365 admin center to check their licenses and verify their AD join status by running dsregcmd /status.

Intune enrollment fails

Blocked Intune enrollments are typically caused by conflicting registry settings and/or a bad Service Connection Point (SCP) in hybrid environments. Verify your SCP configuration in Active Directory and review the relevant keys under:

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM

Endpoint Analytics missing

If Endpoint Analytics isn’t being displayed, turn on Endpoint Analytics data collection in the Intuneadmin center and check if the device runs a supported OS version. For accuracy and compatibility, Endpoint Analytics relies on specific telemetry services available in modern Windows versions.

Policy not applying

If a device isn’t adapting to your policies, inspect its compliance status via Microsoft Graph PowerShell cmdlets (e.g., Connect-MgGraph -Scopes “DeviceManagementConfiguration.Read.All”

Get-MgDeviceManagementConfigurationPolicyAssignment).

If that doesn’t work, open the Intune admin center and do the following:

1. Navigate to Troubleshooting + support > Troubleshoot.
2. Select the affected user.
3. Review device health, assigned policies, and compliance status.

Autopilot errors during enrollment

If Autopilot fails with ambiguous errors, use the new Autopilot Diagnostics Page (ADP) introduced in recent updates. It provides detailed status information for profile assignment, policy application, and connectivity checks.

NinjaOne services can optimize Microsoft endpoint management

NinjaOne enhances the Microsoft Intune experience by providing valuable insight into endpoints outside of Intune’s scope – on Windows, Linux, iOS, iPadOS, Android, and macOS.

NinjaOne RMM also automates script-based configurations to simplify Intune enrollment for a faster, hands-free approach.

Whether it’s proactive drift detection or report creation for enrolled and non-enrolled devices, supplementing your IT toolkit with NinjaOne’s flexible solutions facilitates Microsoft endpoint management across your digital workspace.

NinjaOne can also help bridge gaps in multi-OS environments (Linux, macOS, Android) where Intune’s native capabilities may be limited, ensuring IT teams retain full visibility across all endpoints.

Enhance Microsoft Intune with automated solutions

Microsoft Intune gives you the reins to configure, monitor, and secure enrolled devices across your organization. However, the methods used can be risky, so exercise caution, test often, and always prepare a backup.

With that in mind, system admins can also automate the hardest aspects of Intune setups with modern endpoint solutions that drive employee productivity from a single pane of glass.

Related topics:

• Choosing the Right Software Deployment Tool: Intune vs. NinjaOne – A User’s Perspective
• Intune vs SCCM: A Comparison of Microsoft Solutions
• 10 Best Software Deployment Tools for IT Professionals in 2026