www.it-connect.fr
EnterpriseEnrollment Changes: What’s New for Windows Device Enrollment in Intune
Starting January 15, 2027, Windows will no longer automatically find the Intune enrollment service through the EnterpriseEnrollment DNS CNAME record during a “MDM-only” enrollment. Here’s what you need to know.
Microsoft announced this on October 15, 2026 via the MC1509780 message published in the message center, then detailed it in a post on the Intune Customer Success blog. Microsoft says January 15 “or shortly after.” The MDM-only mode is not being removed, though: only DNS-based automatic discovery is going away. This means users will need to enter the Intune enrollment server URL themselves if the flow does not already provide it.
What is the "EnterpriseEnrollment" DNS record used for?
This CNAME DNS record had to be added to the DNS zone of a public domain in a Microsoft Intune tenant during its configuration. It allows Windows to automatically detect whether an MDM service is present in the Microsoft 365 environment based on the email address of the user performing the action.
This option applies to Windows and is available under Settings > Accounts > Access work or school > Enroll only in device management.
In Microsoft Intune, this option allows a device to be enrolled without being joined to Entra ID, whether in a hybrid or cloud setup.
Who is affected by this change?
This change affects organizations using Windows "MDM-only" enrollment and that configured an EnterpriseEnrollment CNAME in their DNS so Windows could automatically find the Intune service. Devices that are already enrolled are not affected. Organizations without this CNAME, or those enrolling devices in another way (for example via Microsoft Entra join), are not affected either. In other words, only new MDM-only enrollments will be impacted.
As of January 15, 2027, users will need to enter the Intune enrollment server URL themselves:
https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svcHow can I tell whether my organization is affected?
Check whether the DNS record exists
There is no magic button to tell whether you are affected. However, several actions can be taken to understand the impact on your environment.
First, check for the presence of the EnterpriseEnrollment CNAME record in the DNS zone for your domain names. I recommend paying particular attention to the domains used for your UPN suffixes. This is the part after the @ sign in a Microsoft 365 identifier.
You can verify the presence of this CNAME record on your public domains with the following PowerShell command:
Resolve-DnsName -Name EnterpriseEnrollment.votredomaine.com -Type CNAMEThe CNAME normally points to EnterpriseEnrollment-s.manage.microsoft.com. The "CNAME Validation" test in the Intune admin center can also be used to verify this. To access it, go to Intune admin center > Devices > Enrollment > Windows > CNAME Validation.
Check whether enrolled devices exist in Intune in "MDM-only" mode
Because this method allows a Windows computer to be enrolled without joining Entra ID, it is important to check this point to know whether you are affected. You therefore need to look for devices managed in Intune without Entra join.
You can do this through the Intune admin center, then navigate to Devices > Windows > All devices. Next, add the "Microsoft Entra device ID" column.
- If the device is not enrolled as MDM-only, its Entra ID identity will be shown.
- If the device is enrolled in "MDM-only" mode, no Entra ID identity will be shown.
What changes for the user experience?
During a new MDM-only enrollment, the user will need to enter the Microsoft enrollment server URL themselves if the flow does not already provide it.
Today, the user enters their work email address in the MDM-only enrollment flow. Windows then looks for the EnterpriseEnrollment CNAME for the domain of that address. If it finds it, the device discovers the Intune service without any further input.
To reduce support calls, update your MDM enrollment documentation before the deadline. If possible, prefer a method that does not depend on the CNAME, such as Autopilot or Microsoft Entra join.
| Step | Before | After January 15, 2027 |
|---|---|---|
| Enrollment service discovery | Automatic, via the EnterpriseEnrollment CNAME | No more CNAME-based discovery |
| User input | Email address | Email address, then the server URL if it is not provided |
| Support role | No special requirement | Provide the URL to users (listed at the beginning of the article) |
Conclusion
This change only affects Windows MDM-only enrollment that relies on the EnterpriseEnrollment CNAME to find the Intune service. Devices that used this method to enroll in Intune will continue to work after January 15, 2027. Only automatic CNAME discovery is going away, not Intune MDM-only mode itself. Make sure to review your MDM enrollment procedures and documentation so you can include the service URL.
