Microsoft Intune will end support for CNAME-based auto-discovery in Windows MDM-only enrollment scenarios on January 15, 2027. This change is part of Microsoft’s effort to simplify and modernize enrollment experiences by reducing dependency on DNS-based discovery.

What changes

Currently, organizations that use an EnterpriseEnrollment DNS CNAME record benefit from automatic discovery of the Microsoft enrollment service during Windows MDM-only enrollment. Devices locate the enrollment endpoint without any manual input from the user.

After January 15, 2027, this CNAME-based auto-discovery will no longer work in Windows MDM-only enrollment. If the enrollment service URL is not already provided by the enrollment experience itself, users will be prompted to enter it manually. The Microsoft enrollment service URL is:

https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

Who is affected

Organizations are likely affected if they meet all three of the following conditions:

  • Windows MDM-only enrollment is in use.
  • An EnterpriseEnrollment DNS CNAME record has been configured (e.g. EnterpriseEnrollment.contoso.com).
  • The enrollment process relies on that DNS record to automatically discover the enrollment service.

Organizations that exclusively use Microsoft Entra join, Microsoft Entra hybrid join, or other enrollment methods that do not depend on EnterpriseEnrollment CNAME discovery are not affected.

Existing enrolled devices are not affected by this change. Windows MDM-only enrollment itself remains fully supported.

What to do

Microsoft recommends the following five preparation steps before the January 15, 2027 cutoff:

  1. Identify impacted enrollment workflows. Review all Windows MDM-only enrollment scenarios within your organization and determine whether they depend on EnterpriseEnrollment DNS discovery.
  2. Update enrollment documentation. Update user guides, knowledge base articles, onboarding materials, and other instructions to reflect the new enrollment process.
  3. Prepare support teams. Ensure help desk and deployment teams understand the change and know when the enrollment service URL may need to be provided.
  4. Test enrollment scenarios. Validate affected enrollment workflows before the change takes effect. Identify any required updates and determine where users may be prompted to enter the enrollment service URL.
  5. Communicate with impacted users. If users will need to enter the enrollment service URL, provide updated instructions before the change takes effect.

Sources