Intune Ends CNAME Auto-Discovery for Windows MDM Enrollment

On January 15, 2027, or soon after, Microsoft Intune stops supporting DNS CNAME auto-discovery for Windows MDM-only enrollment. Microsoft announced it on October 15, 2026 (Message Center MC1509780) and explained it the same day on the Intune Customer Success blog. Enrolled devices keep working and MDM-only enrollment is still supported. What changes is how a new device finds Intune. Here is how to tell whether this affects you and what to do before January.

What Is Changing

Some organizations created an EnterpriseEnrollment CNAME record years ago, for example EnterpriseEnrollment.contoso.com pointing to EnterpriseEnrollment-s.manage.microsoft.com. When a user enrolled a Windows device, the device used that record to find the Intune enrollment service on its own, so nobody had to type a server address.

After the change, Windows MDM-only enrollment no longer uses that record. If the enrollment experience doesn't already supply the server, the user is asked to enter it:

https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

Per Microsoft:

• Devices that are already enrolled stay enrolled.
• Windows MDM-only enrollment remains supported. Only CNAME-based discovery goes away.
• Not every user will see the prompt. Some enrollment experiences already provide the server information.

Are You Affected?

MDM-only enrollment is the Enroll only in device management option under Settings > Accounts > Access work or school. It enrolls the device in Intune without registering it in Microsoft Entra ID. You may be affected if all three of these are true:

• You use Windows MDM-only enrollment.
• You have an EnterpriseEnrollment CNAME record on one or more of your sign-in domains.
• Your enrollment process relies on that record to find the enrollment service.

Enrollment through Microsoft Entra ID isn't affected. Microsoft's CNAME documentation already notes that automatic enrollment doesn't need the record.

Where It Will Show Up

The DNS change is small. The work is in the instructions that assume it. Microsoft names them directly: enrollment guidance, documentation, provisioning instructions and help desk procedures. Any of those that say "type your email address and the device does the rest" will be wrong for MDM-only users after January 15.

If the guides aren't updated, the help desk is likely to hear about it first: a new starter or a contractor reaches the prompt, doesn't know the URL, and calls in. Adding the URL to the guide gives them the answer up front.

What to Check Before January 15, 2027

1. Find the records. For each UPN suffix your users sign in with, check whether an EnterpriseEnrollment CNAME exists, for example with Resolve-DnsName EnterpriseEnrollment.contoso.com -Type CNAME in PowerShell. The Intune admin center also has a CNAME Validation test under Devices > Device onboarding > Enrollment > Windows.
2. List the enrollment flows that depend on them. Which Windows devices still enroll MDM-only, and who enrolls them: staff, contractors, a deployment team?
3. Test one flow with the URL entered by hand. You'll know exactly what users see and can screenshot it for the guide.
4. Update the documents. Enrollment guides, knowledge base articles, onboarding packs and help desk scripts, before the holidays rather than in January.
5. Brief support and tell affected users. Make sure the help desk knows when the URL is needed and where to find it.

Don't delete DNS records just because of this change. Microsoft says only CNAME-based auto-discovery for MDM-only enrollment is affected, so review what else depends on your DNS before removing anything. The separate EnterpriseRegistration CNAME is used for Microsoft Entra device registration and isn't part of this announcement.

A Good Moment to Review MDM-Only Enrollment

Microsoft's own Windows enrollment guide doesn't recommend the MDM-only option for personal or BYOD devices, because the device isn't registered in Microsoft Entra ID. Features that depend on that registration, such as Intune Conditional Access, won't work as expected on those devices. If this change turns up MDM-only flows you didn't know you still had, it's worth asking whether Microsoft Entra join, Windows Autopilot or a registered BYOD flow now fits better.

If you are already moving devices off on-premises Active Directory, our site-by-site move from Active Directory to Entra ID shows how that can be done in waves. And while you're in the Intune admin center, it's a good time to find your remaining Windows 10 devices and look at what the Vulnerability Remediation Agent for Intune can flag.

Talk It Through

If you're not sure which of your enrollment paths depend on the EnterpriseEnrollment record, we can check your DNS and enrollment flows with you and help you update the guides before January. Book an Intune enrollment review.

Sources: Microsoft 365 Message Center MC1509780 (Oct 15, 2026); Intune Customer Success blog, Preparing for end of support for CNAME auto-discovery in Windows MDM-only enrollment (Oct 15, 2026); Microsoft Learn, Enable autodiscovery of Intune enrollment server, Windows device enrollment guide for Microsoft Intune and MDM enrollment of Windows devices.