www.it-connect.fr
Intune Windows Enrollment Changes: What Happens to EnterpriseEnrollment
Starting January 15, 2027, Windows will no longer automatically find the Intune enrollment service through the EnterpriseEnrollment DNS CNAME record during a “MDM-only” enrollment. Here’s what you need to know.
Microsoft announced this on October 15, 2026 via message MC1509780 published in the Message Center, then detailed it in a post on the Intune Customer Success blog. Redmond refers to January 15 as “or shortly after.” The MDM-only mode is not being removed: only automatic DNS discovery is going away. This means users will have to enter the Intune enrollment server URL themselves if the flow does not already provide it.
What is the "EnterpriseEnrollment" DNS record used for?
This CNAME DNS record had to be added to the DNS zone of a public domain in a Microsoft Intune tenant during its configuration. It allows Windows to automatically detect whether an MDM was present in the Microsoft 365 environment based on the email address of the user performing the action.
This option applies to Windows and is available under Settings > Accounts > Access work or school > Enroll only in device management.
In Microsoft Intune, this option lets you enroll a device without it being joined to Entra ID, whether in a hybrid or cloud scenario.
Who is affected by this change?
This change affects organizations using Windows “MDM-only” enrollment and that have configured a EnterpriseEnrollment CNAME in their DNS so that Windows can automatically find the Intune service. Devices that are already enrolled are not affected. Organizations without this CNAME, or those enrolling devices through other methods (for example via Microsoft Entra join), are not affected either. In other words, only new MDM-only enrollments will be impacted.
As of January 15, 2027, users will have to enter the Intune enrollment server URL themselves:
https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svcHow do I know whether my organization is affected?
Check for the DNS record
There is no magic button to tell you whether you are affected. However, several actions can be taken to understand the impact on your environment.
First, check for the presence of the EnterpriseEnrollment CNAME record in the DNS zone for your domain names. I recommend paying particular attention to the domains used for your UPN suffixes. This is the part that appears after the @ sign in a Microsoft 365 identifier.
You can check for this CNAME record on your public domains using the following PowerShell command:
Resolve-DnsName -Name EnterpriseEnrollment.votredomaine.com -Type CNAMEThe CNAME normally points to EnterpriseEnrollment-s.manage.microsoft.com. The "CNAME Validation" test in the Intune admin center can also be used to verify this. To access it, go to Intune admin center > Devices > Enrollment > Windows > CNAME Validation.
Check for devices enrolled in Intune in "MDM-only" mode
Since this method allows you to enroll a Windows computer without joining it to Entra ID, it is important to verify this point to determine whether you are affected. You therefore need to look for devices managed in Intune without Entra join.
You can do this through the Intune admin center, then navigate to Devices > Windows > All devices. Next, add the "Microsoft Entra device ID" column.
- If the device is not enrolled in MDM-only mode, its Entra ID identity will be shown.
- If the device is enrolled in "MDM-only" mode, no Entra ID identity will be shown.
What changes for the user experience?
The user will have to enter the Microsoft enrollment server URL themselves during a new MDM-only enrollment, if the flow does not already provide it.
Today, the user enters their work email address in the MDM-only flow. Windows then looks up the EnterpriseEnrollment CNAME for the domain in that address. If it finds it, the device locates the Intune service without any further input.
To reduce support requests, update your MDM enrollment documentation before the deadline. If possible, favor a method that does not depend on the CNAME, such as Autopilot or Microsoft Entra join.
| Step | Before | After January 15, 2027 |
|---|---|---|
| Enrollment service discovery | Automatic, via the EnterpriseEnrollment CNAME | No more CNAME-based discovery |
| User input | Email address | Email address, then server URL if it is not provided |
| Support role | No specific action required | Provide the URL to users (listed at the beginning of the article) |
Conclusion
This change only affects Windows MDM-only enrollment that relies on the EnterpriseEnrollment CNAME to find the Intune service. Devices that used this method to enroll in Intune will continue to work after January 15, 2027. Only automatic discovery via CNAME is going away, not Intune MDM-only mode itself. Be sure to review your MDM enrollment procedures and documentation to include the service URL.
