Intune CNAME Auto-Discovery Ends January 15, 2027: Is Your Small Office Affected?

By Justin N. · Published 2026-10-25 · This page may contain affiliate links

Microsoft is ending one small convenience in Intune: starting January 15, 2027, or soon after, Windows PCs enrolled with "Enroll only in device management" will no longer find Intune automatically through your EnterpriseEnrollment DNS record. Most Business Premium offices won't notice. If yours is one of the few that will, the fix is updating your setup instructions, not rebuilding anything.

Who this is for: a 5–50 person business that enrolls Windows PCs in Microsoft Intune, or an IT person who looks after one. Everything below was checked against Microsoft's Message Center post, the Intune team's blog and Microsoft Learn on 2026-10-25.

The short answer

What's changing: Starting January 15, 2027, or soon after, Intune stops supporting DNS CNAME auto-discovery for Windows MDM-only enrollment (Message Center MC1509780, archived copy).
What isn't changing: Microsoft says devices that are already enrolled aren't affected, and Windows MDM-only enrollment itself stays supported. Only the automatic DNS lookup goes away (Intune Customer Success blog).
Probably not you: Microsoft says you likely aren't affected if you only use Microsoft Entra join or Microsoft Entra hybrid join enrollment.
If it is you: after the change, users may have to type the enrollment server URL when Windows asks for it: https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc (MC1509780). Update your instructions before January.

What "CNAME auto-discovery" actually does today

Microsoft Learn still recommends an EnterpriseEnrollment CNAME if you aren't using automatic enrollment, so that users "don't have to enter the server address during device enrollment." The record points EnterpriseEnrollment.yourdomain.com at EnterpriseEnrollment-s.manage.microsoft.com. If Windows can't find the record, Learn says users are prompted to enter the MDM server name by hand (Enable autodiscovery of Intune enrollment server).

Learn also says that if you enroll Windows devices with MDM automatic enrollment, you don't have to worry about this CNAME, because the MDM server is set by default when automatic enrollment is turned on (same article).

Heads-up on the docs: as of 2026-10-25, that Learn article (last updated 2026-07-01) doesn't mention the January 2027 change yet. The retirement is announced in the Message Center post and the Intune team's blog, both linked above. Expect Learn to catch up.

Who's affected

Microsoft's blog says your organization may be affected if all three are true (Intune Customer Success blog):

You use Windows MDM-only enrollment.
You have an EnterpriseEnrollment DNS CNAME record.
Your enrollment process depends on that record to find the enrollment service.

It says you likely aren't affected if you only use Microsoft Entra join, Microsoft Entra hybrid join, or other enrollment methods that don't rely on EnterpriseEnrollment CNAME discovery.

What counts as "MDM-only" enrollment

In Windows, this is the Settings > Accounts > Access work or school > Enroll only in device management link. Microsoft's Windows documentation lists it as its own path, separate from joining a device to Microsoft Entra ID. When Windows can't find the enrollment service automatically, it shows: "We couldn't autodiscover a management endpoint matching the username entered... If you know the URL to your management endpoint, enter it." (MDM enrollment of Windows devices). If your setup sheet tells people to click that link, keep reading.

Common small-office setups

How your PCs get into Intune	Affected?	Why
Joined to Microsoft Entra ID during setup or from Settings, with automatic enrollment on (the usual Business Premium setup)	Likely not	Microsoft lists Entra join enrollment as likely unaffected.
Windows Autopilot	Likely not	Microsoft's blog doesn't name Autopilot, but Learn says registering devices in Autopilot joins them to Microsoft Entra (Windows enrollment guide), and Entra join is listed as likely unaffected. This is our reading, not a Microsoft statement.
Hybrid joined PCs (on-premises Active Directory), including co-managed PCs	Likely not	Microsoft lists Entra hybrid join enrollment as likely unaffected.
"Enroll only in device management" from Settings, relying on your `EnterpriseEnrollment` CNAME	Yes	This is exactly the scenario Microsoft is retiring.
Personal (BYOD) Windows PCs	Depends on the steps	Learn says Windows BYOD enrollment can either register or join devices (Windows enrollment guide). Microsoft's blog doesn't address registered devices directly. If your BYOD steps use "Enroll only in device management," treat it as affected.
PCs already enrolled	No	Microsoft says existing enrolled devices aren't affected.

Automatic MDM enrollment needs Microsoft Entra ID P1 or P2 (Enable MDM automatic enrollment for Windows). Business Premium includes Entra ID P1 (Microsoft Entra licensing), which is why most Business Premium offices use join-based enrollment and aren't affected.

How to check in 10 minutes

1. Look for the DNS records (read-only)

From any Windows PC, open PowerShell and replace yourcompany.com with each domain your users sign in with. These commands only read public DNS. They don't change anything.

Resolve-DnsName -Name enterpriseenrollment.yourcompany.com -Type CNAME
Resolve-DnsName -Name enterpriseregistration.yourcompany.com -Type CNAME

Or, from Command Prompt on any computer:

nslookup -type=CNAME enterpriseenrollment.yourcompany.com
nslookup -type=CNAME enterpriseregistration.yourcompany.com

(Resolve-DnsName · nslookup)

enterpriseenrollment points to a manage.microsoft.com name (Learn's recommended target is EnterpriseEnrollment-s.manage.microsoft.com): you have the record this change is about. Go to step 2.
No enterpriseenrollment record: CNAME auto-discovery was never doing anything for you, so this change doesn't affect you.
enterpriseregistration points to EnterpriseRegistration.windows.net. Learn describes it as a separate record that Microsoft Entra uses for device registration (Learn). The retirement announcement doesn't mention it. Leave it alone.

If your users sign in with more than one domain, Learn says each one gets its own EnterpriseEnrollment record, so check each domain.

You can also test the record in the Intune admin center: Devices > Device onboarding > Enrollment > Windows > CNAME Validation (same Learn article).

2. Check how you actually enroll PCs

Having the record doesn't mean you depend on it. Ask:

Does any setup sheet, onboarding checklist or help-desk article say "Enroll only in device management"?
Does anyone enroll PCs without joining them to Microsoft Entra ID, such as a contractor's laptop or a shared PC?
Is automatic enrollment turned on? In the Intune admin center, go to Devices > Device onboarding > Enrollment > Windows > Automatic Enrollment and look at the MDM user scope (Learn).

If all your answers point to Entra join or Autopilot, you're done. Put a note in your IT docs saying you checked.

What to do before January 15, 2027

Microsoft's recommended steps, shortened (Intune Customer Success blog):

Find the workflows that depend on the record. List every way a Windows PC gets enrolled in your office.
Update your documentation. Add the enrollment server URL to any MDM-only steps: https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc.
Tell whoever does your help desk. Even if that's you, write down when the URL might be needed.
Test now. Microsoft "strongly recommend[s]" testing as early as possible. Enroll a spare PC using your current steps and note where Windows asks for a server address.
Tell affected users before the change if they'll need to type the URL.

Better long-term fix: if you have Business Premium and you're still using MDM-only enrollment for company PCs, ask whether those PCs should be Entra joined instead. The Intune setup guide walks through join-based enrollment. Test on one PC first.

Should you delete the DNS record?

Not yet, and not because of this change. Microsoft's own answer is: "Review your environment and DNS configuration requirements. This change only affects use of the record for Windows MDM-only enrollment auto-discovery." (Intune Customer Success blog). Leaving the record in place does no harm, and removing it won't stop the change from affecting you.

Quick answers

Will every user have to type the URL? Microsoft says not necessarily. Some enrollment experiences already provide it. Manual entry is needed only when they don't.
Do enrolled PCs need re-enrolling? No. Microsoft says existing enrolled devices aren't affected.
Does this affect iPhones or Android phones? The announcement covers Windows MDM-only enrollment only.

Sources

Useful links for this guide: Microsoft's CNAME article. These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-25. If something has moved, tell me at [email protected].