'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Intune Device Credential Enrollment for Azure Windows 11 Multi-Session VMs
Question details
The user needs to resolve an invalid MDM server message encountered during Intune device credential enrollment on a multi-session virtual machine.
- Product
- Microsoft Azure / Intune
- Device & OS
- Windows 11
- Scenario
- Attempting to perform hybrid join and Intune enrollment using device credentials on an Azure Windows 11 multi-session VM.
- Observed behavior
- An invalid MDM server message appears when trying to enroll the VM using device credentials.
Verify that your Azure AD and Intune MDM authority configurations are properly set up and that you have administrator access to your Azure portal.
Consult the Azure Virtual Machines Specialist Team
Because Windows 11 multi-session VMs have highly specific requirements for hybrid join and Intune enrollment, the most effective approach is to have Microsoft specialists review your configuration.
Standard Intune enrollment processes often differ for multi-session environments. An invalid MDM server message usually indicates a mismatch between the enrollment method and the multi-session architecture supported by Microsoft Azure.
Navigate to the official Microsoft Q&A platform and go to the section specifically tagged for Azure Virtual Machines.
Create a new thread detailing your Windows 11 multi-session setup, the steps you took for hybrid join, and the exact 'invalid MDM server' error message you received.
Monitor your post for a response from the Microsoft specialist team, who can confirm whether device-credential enrollment is supported for your specific architecture and provide the necessary PowerShell scripts or policy adjustments.
Equip Your Azure Windows 11 VMs with WPS Office
While configuring management policies for your Azure Windows 11 multi-session VMs, consider deploying WPS Office. It provides a lightweight, free, and highly compatible alternative to Microsoft Office, saving licensing costs for your multi-session environment while ensuring users can open and edit all necessary documents.
- 1. Download the Installer: Visit the official WPS Office website from your Windows 11 VM browser and click the free download button.
- 2. Install on the Virtual Machine: Run the downloaded executable file to deploy the software across your multi-session environment.
- 3. Open and Edit Files: Launch WPS Writer, Spreadsheet, or Presentation to seamlessly manage your Microsoft Office documents.
Frequently Asked Questions
Does Intune support Windows 11 multi-session VMs?
Yes, Intune can manage Windows 11 multi-session VMs, but they must be deployed as part of Azure Virtual Desktop and have specific requirements for hybrid Azure AD join compared to standard single-session devices.
What causes the invalid MDM server error during enrollment?
This error typically occurs if the MDM authority is not properly configured in Azure Active Directory, if the enrollment URLs are incorrect, or if device-credential enrollment is not supported for your specific multi-session deployment.
How can I verify the hybrid Azure AD join status on my VM?
Open Command Prompt as an administrator and type 'dsregcmd /status'. Look for 'AzureAdJoined' and 'DomainJoined'—both should read 'YES' to confirm a successful hybrid join.
