There are multiple ways to enrol devices into Intune. Here's a clear comparison of each method — when to use which, and what the user experience looks like for each.
Intune supports multiple device enrollment methods, each appropriate for different scenarios. Choosing the right method for each device type and ownership model is an important part of any Intune deployment. Here's a complete comparison.
Windows Autopilot (company-owned, new devices)
Best for: new company-owned Windows devices. The device is pre-registered in Autopilot by the hardware vendor or IT team. On first power-on, the device automatically enrolls in Intune and receives all policies. Zero IT touch required. User experience: plug in, sign in, wait 15–30 minutes, device is ready.
User-driven enrollment (company-owned, existing devices)
Best for: existing company-owned devices that weren't provisioned through Autopilot. The user installs the Intune Company Portal app or uses Settings → Accounts → Access work or school. Requires more user action but enables management of legacy devices. IT should guide users through the process.
Bulk enrollment (shared/kiosk devices)
Best for: shared devices, kiosks, or devices that won't have a primary assigned user. Uses a provisioning package or Windows Configuration Designer to configure and enroll multiple devices simultaneously. No user credentials required during enrollment.
Co-management (hybrid Entra joined devices)
Best for: organisations with existing on-premises Active Directory and MECM/SCCM. Devices are joined to both on-premises AD and Entra ID, managed by both MECM and Intune simultaneously. Allows gradual migration of workloads from on-premises management to cloud. Optimyze uses co-management for clients with significant on-premises infrastructure during cloud migration transitions.
BYOD (App Protection Policies, no device enrollment)
Best for: personal devices where full enrollment is inappropriate. No device enrollment — App Protection Policies apply only to specific managed apps. User privacy is maintained. Optimyze deploys App Protection Policies for all clients with BYOD mobile users.
