Question

Contoso has Microsoft Entra ID P1 and Microsoft Intune. The IT team wants all corporate Windows 11 laptops to enroll in Intune automatically when employees perform an Entra join during the out-of-box experience. Sales users, who are in a group named 'Sales-Users', must NOT have their devices automatically enrolled because they are managed by a third-party MDM. All other users should have automatic MDM enrollment. What should you configure?

Accepted Answer

In the Entra admin center under Mobility (MDM and MAM) for Microsoft Intune, set the MDM user scope to 'Some' and assign the group of all users except Sales-Users.

Answer

In the Intune admin center, set the MDM user scope to 'All' and create a device compliance policy that excludes the Sales-Users group.

Answer

In the Intune admin center, create a Windows enrollment restriction that blocks personally owned Windows devices for the Sales-Users group.

Answer

In the Entra admin center, configure device settings so that only members of a selected group may join devices to Entra ID.