Automatic enrollment in Microsoft Intune for Windows devices is configured by setting the MDM user scope within Azure Active Directory. This setting specifically determines which users can automatically enroll their devices into Intune when they join them to Azure AD or register them with their work account. Because the enrollment action is tied to the user's identity, this scope must be assigned to a user group. Assigning the policy to a device group is incorrect, as device groups are used for targeting policies and applications to devices that are already enrolled, not for triggering the enrollment process itself. The MAM user scope pertains to application management without full device enrollment and is not used for automatic MDM enrollment.

Microsoft Corporation. (2024). Set up enrollment for Windows devices by using Microsoft Intune. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods.

Reference Point: In the "Configure automatic MDM enrollment" section, the documentation explicitly states: "Under MDM user scope, select Some to specify the user groups that can automatically enroll their Windows devices... The MDM user scope takes precedence if both the MDM and MAM user scopes are enabled." This directly confirms the correct configuration setting and its assignment to user groups.

Microsoft Corporation. (2024). Quickstart: Set up automatic enrollment for Windows devices. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/enrollment/quickstart-setup-auto-enrollment.

Reference Point: Step 3, "Configure automatic enrollment," instructs the administrator to navigate to Automatic Enrollment and configure the MDM user scope, with the option to select specific groups of users. This reinforces that this is the precise setting for enabling the feature.

Vichova, P., & Ecer, D. (2020). Mobile Device Management in Enterprise Environment. In 2020 43rd International Conference on Telecommunications and Signal Processing (TSP) (pp. 209-212). IEEE. https://doi.org/10.1109/TSP49548.2020.9163533

Reference Point: Section III, "MDM IMPLEMENTATION AND PRINCIPLES," discusses the enrollment phase, noting that it is typically initiated by the user, which aligns with the principle of applying enrollment policies based on user identity rather than pre-existing device objects.