'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Hybrid Joined Devices Missing in Intune for One Domain
Question details
The user is managing two on-premises domains under a single Microsoft Entra tenant and is trying to get devices from both domains to appear in Intune.
- Product
- Microsoft Intune
- Device & OS
- not provided
- Scenario
- Enrolling multiple on-premises domains into a single Microsoft Entra tenant and Microsoft Intune instance.
- Observed behavior
- Devices from one domain successfully appear in Intune, while devices from the second domain are missing, despite all CNAME records being validated and devices showing as Microsoft Entra hybrid joined.
Ensure you have Intune Administrator or Global Administrator privileges in your Microsoft Entra tenant to view and modify device enrollment and discovery policies.
Review Enrollment Policies and Discovery Settings
Verify that the automatic enrollment policies and Microsoft Entra hybrid join settings are correctly applied to the affected domain.
Even if devices show as hybrid joined in Entra, they will not appear in Intune unless the MDM auto-enrollment scopes and discovery policies are configured to encompass the users or devices from that specific domain.
Navigate to the Microsoft Entra admin center, go to Mobility (MDM and MAM) > Microsoft Intune, and ensure the MDM user scope includes the users or groups from the non-working domain.
Open Microsoft Entra Connect on your server and verify that the device sync settings include the Organizational Units (OUs) where the missing domain's devices reside.
Compare Configurations Between the Two Domains
Identify configuration discrepancies by carefully comparing the settings of the working domain against the non-working domain.
Consult the Microsoft Intune Community
If all configurations and policies match perfectly but devices still fail to appear, the issue may require deeper diagnostic analysis.
Looking for a Lightweight Office Suite for Your Enterprise?
While troubleshooting your Intune deployment, consider WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office. It seamlessly integrates into enterprise environments and is exceptionally easy to deploy via MDM solutions like Intune.
- 1. Download the Installer: Visit the official WPS Office website and download the enterprise or standard installer package.
- 2. Deploy via MDM: Upload the installer to your device management platform to push it across your network efficiently.
- 3. Open and Edit Effortlessly: Launch WPS Office to instantly edit your existing Office documents with zero formatting loss.
Frequently Asked Questions
Why do devices show as hybrid joined in Entra but are missing in Intune?
Being hybrid joined to Microsoft Entra ID only establishes the identity and trust of the device. The device must still complete the MDM enrollment process, which requires a valid Intune license for the user, correct MDM user scopes in Entra ID, and a properly configured auto-enrollment Group Policy Object (GPO).
Do I need separate Intune tenants for different on-premises domains?
No. A single Microsoft Entra tenant and Intune instance can support multiple on-premises domains. However, you must ensure that UPN suffixes are properly routed and that auto-discovery CNAME records for both domains are accurately configured and validated.
How do I manually force a hybrid joined device to enroll in Intune?
You can attempt to trigger enrollment manually by opening the Command Prompt as an administrator on the device, running 'dsregcmd /status' to confirm the join state, and then running the 'gpupdate /force' command to refresh the enrollment GPO.
How can I check if a device failed its Intune enrollment?
You can check the Event Viewer on the affected Windows device. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Look for error events related to MDM enrollment failures.
