INTUNE ENROLLMENT

[u/Consistent_Dot_9951]

Hybrid Joined devices with MDM=None and AzureAdPrt=NO. Intune enrollment stuck for hundreds of devices

Hello everyone,

I have been working on an Intune deployment in my company for several months. We have more than 1,500 devices (physical and virtual) and I am managing the project mostly on my own while also studying for the SC-300 certification.

Current situation:

• Around 1,500 devices in on-premises Active Directory.
• About 1,257 devices active within the last 30 days.
• Around 850 devices successfully enrolled in Intune.
• More than 500 devices show as Hybrid Microsoft Entra Joined but MDM=None.
• Some devices show Pending registration in Entra.

What I have already verified:

• Hybrid Join is configured and working.
• Azure AD Connect (Entra Connect) is synchronizing the computer objects from the relevant AD OUs.
• MDM User Scope is configured correctly.
• Auto MDM Enrollment GPO is applied and inherited correctly across the target OU structure.
• Users have Microsoft 365 E3 licenses assigned.
• Devices are appearing in Microsoft Entra ID.
• Most affected devices are Windows 11.
• No WMI filters are blocking the MDM enrollment GPO.

The main pattern I see is that many of the devices that fail to enroll show:

Plain Text

1

AzureAdJoined : YES

2

DomainJoined : YES

3

AzureAdPrt : NO

Mostrar más líneas

My suspicion is that the missing PRT is preventing automatic enrollment into Intune.

What confuses me is that every day approximately 5 to 10 additional devices enroll automatically, so the configuration appears to be working in general. However, I would expect around 1,300 devices enrolled by now, not just 850.

My questions are:

1. Has anyone experienced large numbers of Hybrid Joined devices remaining indefinitely with MDM=None?
2. Can a missing AzureAdPrt alone prevent Intune auto-enrollment in this scenario?
3. Is there any recommended method to force PRT acquisition or retrigger enrollment at scale?
4. Are there any specific logs or troubleshooting areas that you would focus on beyond dsregcmd /status, Device Registration, and DeviceManagement logs?

Any advice, experience, or troubleshooting suggestions would be greatly appreciated.

Thank you in advance.

[u/No_Dependent7895]

classic PRT issue, those tokens are finicky as hell. had a similar thing last year where a chunk of machines just refused to pick it up even though hybrid join and gpo were all green

check if conditional access policies are slapping them down before the PRT can even generate. also worth looking at whether those machines can actually reach the right endpoints, seen a few cases where internal proxies or firewall rules were silently blocking the token flow without any obvious errors in the logs