Intune: Battle of the MDM Authority

Are you having issues when you are trying to create some Intune Enrollment Restrictions, or is the option to create the enrollment status page greyed out? If that’s the case, you will need to read this blog because there is a big chance the MDM Authority is not configured correctly!

1. Introduction

Today, I was called in to investigate a weird problem. A colleague tried setting up Intune for a new Microsoft 365 customer. In a normal situation, we do this by launching our deployment scripts, but this time, a new colleague wanted to see which steps need to be taken to enroll a customer in Microsoft 365.

Everything was going fine until the enrollment restrictions part. Enrollment restrictions must be configured to prevent personally owned devices from being enrolled or block Android device administrators.

If you want to read more about the difference between Personal and Corporate Devices and how you can enroll them, read this blog

2. The Issues

If you read the blog I mentioned above, you will know that when you use Autopilot, it’s always smart to block the possibility of enrolling personally owned devices. By blocking the possibility of enrolling personal devices, you are making sure only corporate devices can be enrolled!

 But was the option to edit the policy, as shown below, missing? I was like: Huh? Did I lose my sight?

Okay? Also, it seems there is no option to edit the existing policy? I was curious about what else was broken, so let’s try to create a new enrollment restriction policy.

As shown above, it’s greyed out? It’s becoming weird! When trying to change or try to create an Enrollment Status Page (ESP) the button to do so is also greyed out.

Okay…. some weird stuff is going on, that’s for sure! First, I checked to see if I had the proper license to do so. As shown below, the admin user was licensed to use Intune. So what’s next?

3. The Fix

After spending a few minutes on Google, I discovered that the MDM authority needs to be configured under Mobile Device Management Authority. Without this option, creating or editing an enrollment restriction policy is impossible.  

If you want to know which MDM authority is configured, please open the Tenant Administration to check your the Tenant Details.

It should be set to Microsoft Intune as shown below

Let’s see what Microsoft has to say about how this needs to be configured.

But within this tenant, no orange banner was shown. The possibility to configure it within the Azure Ad portal and open Intune is obviously gone, as this old Intune Azure portal is depreciated.

You can guess which option we have got left: PowerShell!!! I quickly realized this configuration is part of our deployment script. So I opened our Tenant deployment script… and there it was, at step 2A: Configure Intune as MDM authority.

# Connecten naar msgraph (install-module microsoft.graph.intune)

Connect-MSGraph
$mdmAuth = (Invoke-MSGraphRequest -Url "https://graph.microsoft.com/beta/organization('$OrgId')?`$select=mobiledevicemanagementauthority" -HttpMethod Get -ErrorAction Stop).mobileDeviceManagementAuthority

# Intune Instellen als MDM Authority

 if($mdmAuth -notlike "intune")
{
    $OrgID = (Invoke-MSGraphRequest -Url "https://graph.microsoft.com/v1.0/organization" -HttpMethod Get -ErrorAction Stop).value.id
    Invoke-MSGraphRequest -Url "https://graph.microsoft.com/v1.0/organization/$OrgID/setMobileDeviceManagementAuthority" -HttpMethod Post -ErrorAction Stop
}

I fired up a PowerShell prompt and copy-pasted the script. After refreshing the enrollment restriction page the options to create or edit the restrictions were instantly available.

If you don’t want to fire off that PowerShell script, you could also just click on this link below to set Intune as the default MDM

Migration evaluation – Microsoft Intune admin center

Conclusion:

I say this quite a lot, but automating your processes will ensure all options are configured with no human errors.  Of course, you will need to make sure everyone knows what the script does, only firing up a PowerShell script with no background knowledge is stupid.