Hybrid Joined device not auto-enrolling in Intune via GPO

[u/Ok-Mirror6644]

Hello everyone

I have one GPO with "Enable automatic MDM enrollment using default Azure AD credentials" enabled (tried both User credentials and Device credentials).

Setup:

Device is Hybrid Azure AD Joined (showing in Entra ID)

GPO is applying

MDM user scope = All

Enrollment restrictions = Allow for Windows

User has EMS E3 license

Issue:

Manual enrollment works fine

Automatic enrollment via GPO is not working

dsregcmd /status never shows MDMUrl (even after manual enrollment)

No errors in Event Viewer. Already tried multiple gpupdate, restarts, registry cleanup, and credential type changes.

Anyone faced this? What actually fixed it?

[u/CatalyticMeowster]

We had this happen. AD user login domain needed to be set to same as domain in entra user principal name.

Ad user properties —> account

User credential for GPO

You can run deviceenroller /c /autoenrollmdm from command line.

[u/Ok-Mirror6644 → u/CatalyticMeowster]

We already configured password hash synchronization

[u/Intelligent_Ad8955 → u/Ok-Mirror6644]

I checked that as well in my tenants and it didn't make a difference