---
title: MDM Enrolling an Existing Entra ID Connected Devices
description: This guide walks you through enrolling a Windows device into Intune when it was already joined to Entra ID before automatic MDM enrollment was configured.
---

[Skip to content](https://knowledge.sittadel.com/mdm-enrolling-an-existing-entra-id-connected-devices#main-content)

[![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/)

- [About Sittadel](https://sittadel.com/about/)
- [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/)
  
  Show submenu for Capabilities

    - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/)
    - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/)
    - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/)
    - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/)
- [Resources](https://sittadel.com/resources/)
- [Knowledge Base](https://knowledge.sittadel.com/)

Open main navigation

Close main navigation

- [About Sittadel](https://sittadel.com/about/)
- [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/)
  
  Show submenu for Capabilities

    - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/)
    - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/)
    - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/)
    - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/)
- [Resources](https://sittadel.com/resources/)
- [Knowledge Base](https://knowledge.sittadel.com/)
- [Get Sittadel](https://sittadel.com/start/)

[Get Sittadel](https://sittadel.com/start/)

 Find answers to your security questions.

- There are no suggestions because the search field is empty.

1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en)
2. [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en)

# MDM Enrolling an Existing Entra ID Connected Devices

## This guide walks you through enrolling a Windows device into Intune when it was already joined to Entra ID before automatic MDM enrollment was configured.

**This method of enrolling has only been validated to work on machines that have an existing Entra ID device record and have a Connected to XXX entry within the Settings \> Account \> Access Work or School section locally on the machine but do not actively show up in Intune or have a Managed by XXX entry when the Connected to XXX entry is expanded.** 

### **Locally Assigning Administrative Privilege**

1. For devices confirmed as **Entra ID–joined** and not **MDM (Intune)-enrolled**, we will want to open the **Control Panel** utility and choose the **User Accounts** header.
   
   ***Note: This verification can be observed in Settings \> Accounts \> Access work or school, a device meets the criteria if you see a Connected by XXX entry that, when expanded, shows only a Disconnect this account setting with a Disconnect action (no Managed by XXX setting and no Info action). Seeing Enroll only in device management under Related settings—even with a Connected by XXX entry—also indicates it’s not MDM-enrolled.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-52-54-4786-PM.png?width=670&height=380&name=image-png-Oct-01-2025-02-52-54-4786-PM.png)**
2. After the **User Accounts** section opens, we will want to choose the **Change account type** action under the **User Accounts** header.
   
   ***Note: If a UAC prompt appears, you must provide an administrator username and password to continue; you can’t proceed without admin privileges on the local session.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-52-37-6924-PM.png?width=670&height=383&name=image-png-Oct-01-2025-02-52-37-6924-PM.png)**
3. After you select **Change account type** and approve the **UAC prompt**, you’ll see all accounts on the device—select the profile for the **primary user**.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-52-04-4006-PM.png?width=670&height=380&name=image-png-Oct-01-2025-02-52-04-4006-PM.png)**
4. With the user selected, the **Account** panel opens—choose the **Change the account type** action.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-51-48-4545-PM.png?width=670&height=382&name=image-png-Oct-01-2025-02-51-48-4545-PM.png)**
5. In the **Account type** section, temporarily set the account to **Administrator**, then select **Change Account Type** to apply; after MDM enrollment has taken place, we will want to revert the account back to a standard user.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-51-34-0462-PM.png?width=670&height=380&name=image-png-Oct-01-2025-02-51-34-0462-PM.png)**
6. After granting temporary admin rights, **restart the device—or sign out and back in—to apply the change**; otherwise, the next steps will fail with **insufficient privileges** errors.

### **Locally Enrolling Device For MDM**

1. Once you’ve granted temporary admin rights and restarted/signed back in, open the **Settings** utility. Go to the **Accounts** tab and select the **Access work or school** setting.  
   ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-59-20-2467-PM.png?width=670&height=291&name=image-png-Oct-01-2025-02-59-20-2467-PM.png)
2. In the **Access work or school** section, you’ll see the device is connected to **your organization’s Entra ID** but not managed by **your organization’s MDM (Intune instance)**. Click the **Enroll only in device management** setting.
   
   ***Note: This action does not remove the existing Entra ID device record. It adds the device to Intune and updates the Entra ID entry to show MDM and Security settings management: Microsoft Intune, and the device appears as Autopilot within the Entra ID portal.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-59-36-2111-PM.png?width=670&height=355&name=image-png-Oct-01-2025-02-59-36-2111-PM.png)**
3. In the text field, enter the **user’s work account email (UPN as shown in Entra ID)**. Click **Next** to proceed to authentication.
   
   ***Note: Before enrolling, confirm the user has an eligible Microsoft 365 license (Business Premium, E3, or E5) and the device runs Windows Pro or higher; otherwise, onboarding can fail or misconfigure the device.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-02-59-52-4540-PM.png?width=413&height=400&name=image-png-Oct-01-2025-02-59-52-4540-PM.png)**
4. After entering a valid **UPN**, a Microsoft sign-in window opens—enter the account **password** and select **Sign in**.
   
   ***Note: If MFA is required, complete the additional prompts after entering your password. Access isn’t granted until MFA is satisfied.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-00-05-7065-PM.png?width=439&height=400&name=image-png-Oct-01-2025-03-00-05-7065-PM.png)**
5. After successful authentication, you’ll see the device **setting up to connect to your workplace**—this confirms the action has succeeded; select **Got it** to continue verifying the local-to-cloud connection.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-00-25-0167-PM.png?width=444&height=425&name=image-png-Oct-01-2025-03-00-25-0167-PM.png)**
6. Return to **Settings \> Accounts \> Access work or school** and look for the briefcase-icon **Connected by XXX** entry. Expand it, then choose the **Info action next to the Managed by XXX setting** to start a local sync with Intune.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-02-31-3561-PM.png?width=670&height=524&name=image-png-Oct-01-2025-03-02-31-3561-PM.png)**
7. In this pane, scroll to **Device sync status** and select **Sync** to force a check-in with Intune and pull configuration settings.  
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-03-45-0273-PM.png?width=670&height=431&name=image-png-Oct-01-2025-03-03-45-0273-PM.png)**
8. After selecting **Sync**, wait for **The sync was successful** prompt (typically 5–10 minutes). If no confirmation appears and the page seems stuck, leave this section and return, then try **Sync** again. Next, go to the **Intune** portal to trigger a **cloud sync** for the device and set the desired **ownership**.

### **Verifying Intune Connectivity**

1. Open the following **Intune Devices** [link](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesWindowsMenu/~/windowsDevices) and confirm the machine now appears. From the list, select the device that just completed MDM enrollment.
   
   ***Note: The device might not show up immediately. Keep triggering local Sync on the device and refresh/reopen this Intune view until it appears.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-08-42-4317-PM.png?width=670&height=353&name=image-png-Oct-01-2025-03-08-42-4317-PM.png)**
2. On the device **Overview** page, we will want to select the **Properties** tab. Next, we will want to set **Device ownership** to **Corporate**, at least for the purpose of this exercise, followed by checking the **acknowledgement box**, and selecting **Save** to finalize the ownership change.
   
   ***Note: The device ownership step can be skipped if you are wishing to Intune Join the machine as Personal; the default ownership assignment for this join method is Personal.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-10-02-7397-PM.png?width=670&height=352&name=image-png-Oct-01-2025-03-10-02-7397-PM.png)**
3. Return to the **Overview** page, here we will want to verify that the **Ownership** is showing **Corporate**. After verification has been carried out, we will want to select the **Sync** action to initiate a cloud sync and expedite deployment of ownership-scoped settings to the newly enrolled MDM device.
   
   ***Note: If the desired device ownership is Personal; the ownerships should show Personal and you will just want to move to conducting the cloud sync action on the device.***
   
   **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Oct-01-2025-03-11-01-2908-PM.png?width=670&height=354&name=image-png-Oct-01-2025-03-11-01-2908-PM.png)**
4. Continue cycling **local Sync (on the device)** and **cloud Sync (in Intune)** until the ownership-scoped configuration profiles apply and the device reaches a **Compliant** state. Reporting in the Intune portal can lag by **up to 20 minutes**—the **Policies** section on the same device page where you trigger **local Sync** **(on the device)** is the source of truth. If results don’t align, **restart** the device and let the initial **post-startup sync run**, then **recheck**.

### Need Assistance?

Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management.

- [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content)

    - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions)
    - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account)
    - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices)
    - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing)
    - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email)
    - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests)
    - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot)
- [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content)

    - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations)
    - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security)
    - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security)
    - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security)
    - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security)
- [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content)

    - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc)
    - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc)
    - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc)
    - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc)
- [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en)
- [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content)

    - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview)
    - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment)
    - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment)
    - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment)
    - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment)
    - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment)
    - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment)
- [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content)

    - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave)
- [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content)

    - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id)
    - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune)
    - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender)
    - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview)
    - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center)
    - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center)
    - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center)
    - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center)

[![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com)

Security for Humans.

Copyright © 2026, Sittadel

<https://www.linkedin.com/company/sittadel> <https://outlook.office365.com/book/StartSittadelcom@sittadel.com/?ismsaljsauthenabled=true> <https://outlook.office365.com/book/StartSittadelcom@sittadel.com/?ismsaljsauthenabled=true>