Enroll to Device management option not available

Use the Access work or school enrollment path instead of looking for the legacy Enroll only in device management option, and verify that automatic MDM enrollment is correctly configured for the user.

Key points based on the scenario:

1. Manual enrollment path on the device
   On Windows 11 Pro, the supported user-driven enrollment for Intune is:
   1. Open Settings > Accounts.
   2. Select Access work or school.
   3. Select Connect.
   4. Sign in with the user’s work account (UPN, for example ******@contoso.com).
   5. Complete the wizard until the You’re all set! screen appears, then select Done.
   6. Confirm the work account is listed under Access work or school.
   This flow registers/joins the device with Microsoft Entra ID and enrolls it into Intune when MDM auto-enrollment is configured. The separate Enroll only in device management option is not required and is not recommended for Intune BYOD scenarios.
2. Confirm the correct enrollment model
   For user/BYOD or org-owned devices, Intune recommends:
   • Use Settings > Accounts > Access work or school > Connect to register or join the device to Microsoft Entra ID, which then drives Intune enrollment.
   • Avoid the Enroll only in device management (MDM-only) option, as it does not register the device in Microsoft Entra ID and is not recommended for Intune.
3. Fix missing MDM URL (no auto-enrollment)
   dsregcmd /status showing AzureAdJoined: YES but an empty MDMUrl indicates that automatic MDM enrollment is not configured or not applying to this user/device. Verify the following in the tenant:
   1. Intune license
      Ensure the user has a valid Intune license assigned.
   2. Automatic MDM enrollment settings
      In Microsoft Entra ID / Intune configuration:
      • MDM user scope must be set to All (or at least include this user).
      • MAM user scope should be set to None, otherwise it can take precedence and block MDM enrollment.
      • MDM discovery URL must be set to https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc.
   3. Device OS and join state
      • Confirm the device is on a supported version (Windows 10 1709+ or Windows 11).
      • For Group Policy–based auto-enrollment, the device must be Microsoft Entra hybrid joined (AzureAdJoined: YES, DomainJoined: YES, and AzureAdPrt: YES in dsregcmd /status).
4. If using Group Policy–based auto-enrollment
   If the device is domain-joined and should auto-enroll via GPO:
   • Configure the Enable automatic MDM enrollment using default Microsoft Entra credentials Group Policy in on-premises AD and apply it to the device.
   • After Group Policy refresh and sign-in with the domain account, the scheduled task under Task Scheduler > Microsoft > Windows > EnterpriseMgmt should run and enroll the device.
   • If it still fails, use the Intune auto-enrollment troubleshooting guidance and check the DeviceManagement-Enterprise-Diagnostics-Provider logs for specific error codes.
5. Confirm enrollment in Intune
   After fixing the MDM scope and re-running the join/enrollment flow:
   • Sign in to the Intune admin center.
   • Go to Devices > All devices and verify that the device appears as enrolled.

If the device is already Microsoft Entra joined but not enrolling, the usual resolution is to correct the MDM user scope / MAM scope / discovery URL, ensure licensing, then disconnect the work account, reboot, and re-join via Access work or school > Connect so that the MDM enrollment is triggered with the corrected configuration.

References:

• Step 5 - Enroll a Windows device in Microsoft Intune
• Enrollment guide: Enroll Windows client devices in Microsoft Intune
• Troubleshooting Windows 10 Group Policy-based auto-enrollment in Intune
• Troubleshooting Windows device enrollment errors in Intune
• MDM enrollment of Windows devices
• Enroll Windows devices in Intune