HOW-TO GUIDE 1

Centrally manage users and devices with Microsoft Entra ID P1 and Intune

1. Purpose

This guide explains how to manage user accounts and company Windows laptops/desktops from the cloud, without a physical domain controller on site. Users sign in to Windows with their Microsoft 365 account, devices join Microsoft Entra ID, and Intune applies security settings and checks that each device is compliant (encrypted, protected by antivirus, firewall on, up to date).

2. Applies to / licence required

3. Prerequisites

• Business Premium licences purchased and visible in Microsoft 365 admin center > Billing > Licenses (licence counts and prices: verify in the portal).
• Company domain (for example contoso.in) added and verified in Microsoft 365 admin center > Settings > Domains.
• Two cloud-only admin accounts, including one emergency (break-glass) account – see Guide 4.
• A test laptop running Windows 10/11 Pro, with internet access and a local administrator account. Back up any local data before joining.
• A list of users and departments (or an export from existing on-premises Active Directory if you plan to sync).

4. Step-by-step procedure

Part A – Create users and assign licences

1. Sign in to the Microsoft 365 admin center (admin.microsoft.com) and go to Users > Active users > Add a user.
2. Enter first name, last name, display name and username (use the company domain). Choose to auto-generate a password and require a change at first sign-in.
3. On Assign product licenses, select the location India and tick Microsoft 365 Business Premium. Select Next, set roles (leave as User for normal staff), then Finish adding.
4. For bulk creation, use Users > Active users > Add multiple users and upload the CSV template provided on that page.
5. Alternatively, create users in the Microsoft Entra admin center > Entra ID > Users > All users > New user > Create new user.

[SCREENSHOT PLACEHOLDER – Microsoft 365 admin center – Add a user, licence assignment page]

Part B – Create groups (including a pilot/test group)

6. In the Microsoft Entra admin center, go to Entra ID > Groups > All groups > New group.
7. Set Group type to Security, give a clear name (for example SG-Intune-Pilot), set Membership type to Assigned, add 2–5 IT users as members, then select Create.
8. Create other groups as needed, for example SG-All-Staff, SG-Plant-Users, SG-Office-Users. With Entra ID P1 you can use Dynamic User membership (for example by department) and group-based licensing.

Note: Always assign new Intune policies to the pilot group first. Widen to all users only after the pilot devices show the expected results.

Part C – Allow users to join devices to Entra ID

9. In the Entra admin center, go to Entra ID > Devices > All devices > Device settings (on some tenants: Entra ID > Devices > Overview > Device settings).
10. Set Users may join devices to Microsoft Entra to Selected (choose the pilot group) during the pilot, or All for full rollout.
11. Review Require Multifactor Authentication to register or join devices and the local administrator settings (for example, restrict who becomes local admin on joined devices). Select Save.

Part D – Turn on Intune automatic enrollment (MDM user scope)

12. Sign in to the Microsoft Intune admin center (intune.microsoft.com).
13. Go to Devices > Device onboarding > Enrollment, select the Windows tab, then Automatic Enrollment.
14. Set MDM user scope to Some and select the pilot group (SG-Intune-Pilot). Change to All after the pilot.
15. Leave MDM terms of use URL, MDM discovery URL and MDM compliance URL at their default values. Set WIP user scope (shown as MAM user scope on some tenants) to None.
16. Select Save.

[SCREENSHOT PLACEHOLDER – Intune admin center – Automatic Enrollment, MDM user scope = Some]

Part E – Join and enroll a test laptop

17. On the Windows 10/11 Pro laptop, open Settings > Accounts > Access work or school > Connect.
18. Select Join this device to Microsoft Entra ID (link at the bottom of the window – do not type the email into the main box, which only registers the account).
19. Sign in with the pilot user's Microsoft 365 account, complete MFA if prompted, confirm the organisation name and select Join, then Done.
20. Sign out and sign in again as the work account (use Other user and the full email address). Windows Hello for Business setup may start – complete it.
21. Back on Access work or school, select the connected account and choose Info: you should see Intune (MDM) management details. Select Sync.
22. For a brand-new laptop, you can instead sign in with the work account during first-time setup (out-of-box experience) and choose the work or school option.

Part F – Create a basic Windows compliance policy

23. In the Intune admin center, go to Devices > Compliance > Policies > Create policy (on some layouts: Devices > Manage devices > Compliance). Choose platform Windows 10 and later, then Create.
24. Name it CP-Windows-Baseline and configure the settings below, then select Next.

25. On Actions for noncompliance, keep Mark device noncompliant and set a grace period (for example 1–3 days). Optionally add Send email to end user.
26. On Assignments, add the pilot group. Select Create.
27. Go to Devices > Compliance > Compliance settings and set Mark devices with no compliance policy assigned as to Not compliant before you enforce Conditional Access (Guide 4).

Part G (optional) – Sync existing on-premises Active Directory

If you still have an on-premises AD you want to keep for now, synchronise identities so users keep the same username and password:

28. In the Entra admin center, open Entra ID > Entra Connect and review the options. For most small sites Microsoft recommends Microsoft Entra Cloud Sync (lightweight agent); Microsoft Entra Connect Sync is the traditional full installer.
29. Install the chosen agent on a domain-joined Windows Server (not on a user PC), select Password hash synchronisation, and scope sync to the OUs that hold real users and groups.
30. Make sure each on-premises user's UPN suffix matches the verified Microsoft 365 domain before the first sync.

Note: If you have no on-premises AD, skip Part G – a cloud-only setup does not need any domain controller.

Windows Autopilot (for new and re-imaged devices)

Once the pilot works, consider Windows Autopilot (Intune admin center > Devices > Device onboarding > Enrollment > Windows > Windows Autopilot). Devices purchased through a supporting vendor or registered by hardware hash are automatically joined, enrolled and configured when the user first signs in, without IT touching the laptop. Plan Autopilot as a separate project.

5. Verification and testing

• Entra admin center > Entra ID > Devices > All devices: the test laptop shows Join type = Microsoft Entra joined and MDM = Microsoft Intune.
• Intune admin center > Devices > Windows: the device appears with the correct primary user.
• Open the device in Intune and check Device compliance: status should become Compliant (allow up to a few hours; select Sync to speed up).
• On the laptop, run dsregcmd /status in Command Prompt: AzureAdJoined : YES.
• Sign in as a user not in the pilot group to confirm they are not yet auto-enrolled (expected during the pilot).

6. Troubleshooting / common issues

7. Best practices

• Pilot with IT staff first, then one department, then the whole company.
• Use groups for every assignment – never assign policies to individual users.
• Keep two emergency admin accounts excluded from restrictive policies.
• Use a clear naming convention for groups and policies (SG-, CP-, CA- prefixes).
• Remove standard users from local administrator rights on joined devices.
• Review non-compliant devices weekly in Intune > Devices > Monitor.

8. Glossary

9. Need help with rollout?

Need help planning or rolling this out across your sites? Contact Kalpesh Adhvaryu (IT consultancy) for rollout support, pilot planning and hands-on configuration.

Portal menus change regularly. This guide was checked against Microsoft Learn documentation in October 2026; if a menu name differs in your tenant, search for the setting name in the portal or check the linked Microsoft Learn topic.