Prepare infrastructure for devices
Start with the identity join type
Every enrollment decision begins with how the device will be identified in Microsoft Entra ID. Microsoft Entra joined devices are cloud-first corporate devices. Microsoft Entra hybrid joined devices are also joined to on-premises AD and need Microsoft Entra Connect (and device writeback in some designs). Microsoft Entra registered devices are usually BYOD, registered for Conditional Access and app protection without full MDM control.
Tenant and enrollment plumbing
Confirm licensing (Intune Plan 1 ships with Microsoft 365 E3/E5), set MDM authority to Intune, verify domain names, and use enrollment restrictions to control which platforms and personal devices may enroll. Windows Autopilot relies on the hardware hash, a deployment profile, and the enrollment status page. Apple needs ABM/ADE tokens plus an MDM push certificate; Android Enterprise needs a managed Google Play binding; co-management with Configuration Manager needs the Intune Connector for AD.
Traps
Questions confuse registered with joined, assume compliance policies enforce settings, and forget that self-deploying Autopilot requires TPM 2.0, network access, and a device already registered in Autopilot. Device Enrollment Manager accounts are for bulk enrollment and cap at 1,000 devices.
Rule of thumb
If a device must reach on-premises resources with Kerberos while being Intune-managed, choose Entra hybrid join. If users bring personal phones, choose registration plus app protection.