Windows MDM-only enrollment loses EnterpriseEnrollment CNAME auto-discovery in January 2027

For years, an EnterpriseEnrollment DNS record has let Windows users enroll in Intune by typing nothing more than their work email address. Microsoft has announced that, for one specific path, that convenience ends in January 2027. Nothing breaks on devices that are already enrolled, but users and scripts that rely on the record will meet a prompt for a server address they've never seen. In this post I'll explain exactly what changes, how to tell whether you're affected, and how to rehearse the new experience before the date.

What is changing#

Microsoft Learn's page on enabling auto-discovery describes the record: a CNAME such as EnterpriseEnrollment.contoso.com pointing to EnterpriseEnrollment-s.manage.microsoft.com, one per UPN suffix, so users don't have to type the server address. When no record is found, users are prompted for the MDM server name.

According to MC1509780, after the change:

• Windows MDM-only enrollment no longer uses EnterpriseEnrollment CNAME records for automatic discovery.
• Users must enter the Microsoft enrollment server URL when the enrollment experience doesn't already supply it:
  Text

  https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

• Windows MDM-only enrollment itself remains supported. Only the CNAME-based discovery goes away.

Who is affected#

You're affected only if all of these are true:

1. You use Windows MDM-only enrollment: the user goes to Settings › Accounts › Access work or school and selects Enroll only in device management, or opens a deep link that starts the same flow.
2. Your users' domains have an EnterpriseEnrollment CNAME that the flow relies on to find Intune.
3. New devices still enroll this way after mid-January.

Microsoft Entra join, Windows Autopilot, automatic enrollment of hybrid joined devices through Group Policy, co-management and the BYOD Connect flow (Entra registration plus automatic MDM enrollment) aren't in scope: in those flows the MDM server comes from Microsoft Entra ID, which is why the CNAME is optional when automatic enrollment is configured.

What breaks if you do nothing#

• A user following your current instructions types their email address and is then asked for a server they don't know. Expect helpdesk calls and abandoned enrollments.
• Scripts, provisioning steps or kiosk build documents that start MDM-only enrollment and assume discovery will fill in the server stall at the same prompt.
• Devices already enrolled carry on syncing; Microsoft states they aren't affected.

What to do now#

1. Confirm the record exists and what it's used for#

In the Microsoft Intune admin center, go to Devices › Device onboarding › Enrollment, select the Windows tab, then CNAME Validation, and test each of your domains. You can also check from any PC:

'contoso.com','us.contoso.com' | ForEach-Object {
    Resolve-DnsName -Name "EnterpriseEnrollment.$_" -Type CNAME -ErrorAction SilentlyContinue |
        Select-Object Name, NameHost }

A record that resolves only tells you the convenience exists, not that anyone uses it. The next step answers that.

2. Find devices that look MDM-only#

MDM-only devices are enrolled in Intune without being registered in Microsoft Entra ID, so their Entra device ID is empty. This Graph PowerShell query lists Windows devices in that state as a starting point for your review:

Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All'
Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Windows'" `
    -Property deviceName, userPrincipalName, azureADDeviceId, enrolledDateTime |
  Where-Object { -not $_.AzureAdDeviceId -or $_.AzureAdDeviceId -eq '00000000-0000-0000-0000-000000000000' } |
  Sort-Object EnrolledDateTime -Descending |
  Select-Object DeviceName, UserPrincipalName, EnrolledDateTime

Recent enrollment dates in that list mean the flow is still in use. Treat the result as a lead, not proof: check a few devices under Access work or school to confirm how they were enrolled.

3. Update every place that describes the flow#

• User guides, welcome emails, intranet pages and helpdesk scripts: add the server URL above as the answer to the new prompt.
• Deep links: Windows supports ms-device-enrollment:?mode=mdm with optional username and servername parameters, so a link can pre-fill the server, for example:
  Text

  ms-device-enrollment:?mode=mdm&username=someone@contoso.com&servername=https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

  Test it on a pilot device before you publish it.
• Provisioning scripts and build documents that depend on discovery.

4. Ask whether MDM-only is still the right flow#

Microsoft's Windows enrollment guide steers organization-owned devices toward Microsoft Entra join or Autopilot and personal devices toward the BYOD flow. MDM-only devices aren't registered in Entra ID, so device-based Conditional Access can't use them. If the inventory turns up MDM-only enrollments you didn't plan for, this is a good moment to move them.

How to verify#

You can rehearse the post-January experience today. Learn says users are prompted for the server when no enrollment CNAME is found, so run the MDM-only flow on a test device with an account whose UPN suffix has no EnterpriseEnrollment record (for example a verified test domain in your tenant without the record). Good looks like this:

• The prompt for the server appears, the user pastes the URL from your updated guide, and enrollment completes.
• The device appears in Devices › Windows in the Intune admin center and checks in.
• A new user can complete the flow from your guide alone, without help.

Don't delete DNS records because of this announcement. Microsoft says only CNAME-based auto-discovery for MDM-only enrollment is affected, and the separate EnterpriseRegistration record is used for Microsoft Entra device registration.

Timeline#

If enrollments fail for other reasons along the way, the Windows enrollment error codes quick reference covers the common codes.

References#

• Enable auto-discovery of Intune enrollment server
• MDM enrollment of Windows devices (Enroll in device management only, deep links)
• Enrollment guide: Enroll Windows client devices in Microsoft Intune