Microsoft Intune will stop supporting CNAME-based auto-discovery for Windows MDM-only enrollment on January 15, 2027. If a new enrollment depends on an EnterpriseEnrollment DNS record to find the Intune service, users may need to enter the service URL during enrollment.
This is a narrow enrollment change, not an Intune shutdown. Existing enrolled devices remain enrolled, and Microsoft says Windows MDM-only enrollment itself continues to be supported. The work for administrators is to find any onboarding workflow that relies on DNS discovery and prepare users and support teams before the date.
What changes on January 15
| Area | Microsoft change | What to do |
|---|---|---|
| Windows MDM-only enrollment | Intune stops using the EnterpriseEnrollment CNAME for automatic service discovery. | Check whether new enrollments rely on that DNS lookup. |
| New enrollment experience | If the enrollment experience has not supplied the server address, a user may be prompted to enter it. | Test the prompt and prepare the exact URL in user and help desk instructions. |
| Existing managed devices | Already enrolled devices are not affected. | Keep normal device management running; focus testing on new enrollment. |
| Other enrollment methods | Entra join, hybrid join, and other methods that do not rely on this CNAME are outside the stated impact. | Confirm the method used by each enrollment path before assigning work. |
Check whether your tenant is in scope
Microsoft identifies three conditions that indicate likely impact: your organization uses Windows MDM-only enrollment, has an EnterpriseEnrollment DNS CNAME, and depends on that record to automatically discover the enrollment service.
Review every domain used in Windows enrollment, including alternate user principal name suffixes. A common record looks like EnterpriseEnrollment.contoso.com and points to EnterpriseEnrollment-s.manage.microsoft.com. Microsoft’s Intune enrollment guide explains how to verify the record in the admin center. Its presence alone is not enough to prove a workflow is affected; confirm how users and provisioning tools actually enroll devices.
For a quick DNS check, an administrator can run nslookup -type=CNAME EnterpriseEnrollment.contoso.com, replacing contoso.com with each domain in use. Also review enrollment guides, device-provisioning scripts, help desk procedures, and any third-party instructions that assume the service is found automatically.
Give affected users a tested enrollment path
After CNAME auto-discovery ends, Microsoft says users may need to provide this enrollment service URL when the enrollment experience has not already supplied it:
https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc
Do not assume every user will see the same prompt. The practical question is whether each enrollment path supplies the URL itself or asks the user for it. Test that distinction with the exact device and account flow your organization uses, then document the step users will actually see.
A five-step readiness plan
- Inventory the enrollment paths. List Windows MDM-only scenarios, who owns them, and which user or device populations use each one.
- Inspect the DNS records. Check each relevant domain for an
EnterpriseEnrollmentCNAME and record its target. Keep the separateEnterpriseRegistrationrecord out of this change review; Microsoft’s notice is specifically about EnterpriseEnrollment-based discovery. - Test a new enrollment. Use a representative test account and device to validate the post-change path. If practical, use a test domain or isolated pilot so production DNS and active enrollments are not disturbed.
- Update support material. Revise onboarding instructions, screenshots, provisioning runbooks, and help desk scripts. Include the enrollment URL and the point at which users may need to enter it.
- Communicate before the deadline. Tell affected staff what they may see and give the service desk a short troubleshooting path for users who cannot complete enrollment.
Keep the scope precise
This notice does not say to remove all Intune DNS records or to change currently enrolled devices. Avoid broad DNS cleanup based on the headline alone. First identify the enrollment scenario, prove whether it relies on the specified CNAME, and validate the replacement user experience. If no workflow depends on CNAME discovery, document that finding and close the review.
Frequently asked questions
Will currently enrolled Windows devices stop syncing? No. Microsoft says existing enrolled devices remain enrolled and are not affected by the discovery change.
Is Windows MDM-only enrollment going away? No. Microsoft says only CNAME-based auto-discovery is ending; the enrollment method remains supported.
Does every Intune-managed Windows device need an update? No. The relevant scope is new Windows MDM-only enrollment that relies on an EnterpriseEnrollment CNAME.
Should we delete the DNS record now? Not as a blanket action. Confirm dependencies and test the new enrollment path first. The Microsoft announcement changes Intune’s support for using the record; it does not instruct organizations to remove every matching DNS record.
Start with the DNS and enrollment workflows, then assign an owner to each affected path. A tested URL, updated instructions, and a prepared help desk are enough to make this a low-friction change for users.
Need an Intune enrollment review?
We can map Windows enrollment paths, validate dependencies, and prepare a user-tested change plan for your team.
Book a Free Consultation