> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/user/general/check-intune-enrollment-readiness.md).

# Check Intune Enrollment Readiness

Check whether this user can enroll devices in Intune

### Description

Checks whether this user is ready to enroll a device in Intune and reports Ready, Ready with warnings or Not ready together with the blockers found. The check covers the account status, the Intune license, the device enrollment limit, platform restrictions and Conditional Access policies that target device registration or enrollment. Nothing is changed. Details on the checks are in the runbook documentation (docs.realmjoin.com).

### Interpretation notes

* Checks performed: account state, Intune license and service plan, tenant MDM authority, device enrollment limit, platform restrictions, registered authentication methods, Conditional Access policies and, optionally, pilot group membership.
* Conditional Access is evaluated as a static "What If" against the enrollment sign-in for the selected `EnrollmentPlatform`; Entra's own What If tool remains the authority.
* Compliant-device requirements on "All resources" policies do not block enrollment (a documented Entra exemption); only policies targeting device registration or the Intune enrollment apps are treated as strict gates.
* Not evaluated statically: named locations, device filters, sign-in frequency and terms of use.
* Expired or already used Temporary Access Passes are not counted as usable methods.

### Prerequisites

The tenant MDM authority must be "intune" or "office365"; other values block every user.

### What is checked

The readiness verdict combines these checks:

* Account status (enabled, not blocked) and an Intune license assigned to the user.
* The tenant's device enrollment limit for the user and the platform restrictions of the enrollment configuration.
* Conditional Access policies that explicitly target device registration or Intune enrollment. Policies that require a compliant device via *All resources* are exempted by Microsoft Entra design and therefore not counted as blockers.
* Platform-scoped policies and browser-only client-app requirements are evaluated against the chosen enrollment platform; with *All platforms* every platform is evaluated and reported separately.

The runbook only reads; it changes nothing on the user or the tenant.

### Location

User → General → Check Intune Enrollment Readiness

**Full Runbook name**

rjgit-user\_general\_check-intune-enrollment-readiness

### Details

| Property         | Value                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Version          | 1.0.0                                                                                    |
| Required modules | <p>RealmJoin.RunbookHelper (>= 0.8.10)<br>Microsoft.Graph.Authentication (>= 2.41.2)</p> |
| Schedulable      | no                                                                                       |

### Permissions

#### Application permissions

* **Type**: Microsoft Graph
  * DeviceManagementServiceConfig.Read.All
    * *Reads /deviceManagement/deviceEnrollmentConfigurations (limit and platform restriction configs, with assignments expanded) to evaluate enrollment limit and platform restriction findings*
  * Group.Read.All
    * *Reads /groups?$filter=displayName eq '...' to resolve the optional pilot group by name*
  * GroupMember.Read.All
    * *Reads /groups/{id}/transitiveMembers/microsoft.graph.user to check pilot-group membership and /users/{id}/transitiveMemberOf/microsoft.graph.group to resolve the target user's group memberships for Conditional Access include/exclude group scoping*
  * Organization.Read.All
    * *Reads /v1.0/organization/{tenantId}?$select=id,displayName,mobileDeviceManagementAuthority to determine the tenant's MDM authority, an unconditional tenant-level enrollment blocker check; the tenant ID is taken from Get-MgContext as a fast path, falling back to GET /v1.0/organization?$select=id when the Graph context does not yield one*
  * Policy.Read.All
    * *Reads /identity/conditionalAccess/policies to evaluate enabled policies that could block Intune enrollment for the user*
  * RoleManagement.Read.Directory
    * *Populates the roleTemplateId of the directoryRole objects returned by /users/{id}/transitiveMemberOf/microsoft.graph.directoryRole, which Conditional Access includeRoles/excludeRoles scoping is matched against. User.Read.All authorizes the call itself but leaves directoryRole properties null, which would silently make every role-scoped policy appear not to apply*
  * User.Read.All
    * *Reads /users/{id} (accountEnabled, assignedLicenses, usageLocation) to resolve the target user, /subscribedSkus to determine which licenses include an Intune service plan, /users/{id}/ownedDevices to count registered devices against the enrollment limit, and /users/{id}/transitiveMemberOf/microsoft.graph.directoryRole to resolve the user's directory roles for Conditional Access includeRoles/excludeRoles scoping*
  * UserAuthenticationMethod.Read.All
    * *Reads /users/{id}/authentication/methods to determine whether the user has a registered method that can satisfy Conditional Access MFA grant controls*

### Parameters

#### UserName

User principal name of the user the runbook acts on. Set by the portal from the selected user.

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | true                                   |
| Default Value    |                                        |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

#### EnrollmentPlatform

Platform of the device the user wants to enroll. Conditional Access policies scoped to other platforms are ignored; All platforms checks every platform and reports each one.

| Property            | Value              |
| ------------------- | ------------------ |
| Required            | false              |
| Default Value       | Windows            |
| Type                | String             |
| Portal display name | Platform to enroll |

**Portal options**

| Portal option | Value   |
| ------------- | ------- |
| Windows       | Windows |
| iOS / iPadOS  | iOS     |
| Android       | Android |
| macOS         | macOS   |
| All platforms | All     |

#### CheckPilotGroupMembership

Also requires the user to be in the pilot group. Non-members are reported as Not ready.

| Property            | Value                         |
| ------------------- | ----------------------------- |
| Required            | false                         |
| Default Value       | False                         |
| Type                | Boolean                       |
| Portal display name | Check pilot group membership? |

#### PilotGroupDisplayName

Members of this group count as pilot users. The group is looked up by its display name.

| Property            | Value                           |
| ------------------- | ------------------------------- |
| Required            | false                           |
| Default Value       | col - All Users - Pilot (users) |
| Type                | String                          |
| Portal display name | Pilot group name                |

[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/user/general/check-intune-enrollment-readiness.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.