Intune connector for multiple Forests and single Tenant

Question

Hello,

Is it possible to use multiple Intune connectors on multiple Forests and link them to a single Entra ID tenant? knowing that all of these forests are synced with this single entra ID tenant using the same AD connect?

The idea is to use windows AutoPilote for these different forests using the same entra ID tenant

thank you in advance

Answer 1

Hello Jihad

Yes, it is possible to use multiple Intune connectors on multiple forests and link them to a single Entra ID tenant. This is known as a "multi-forest" or "hybrid" deployment.

When you set up multiple Intune connectors in different forests, each connector will register with the same Entra ID tenant and synchronize with it. You can then configure each connector to manage devices and users in its respective forest.

To achieve this, you'll need to:

1. Set up an Azure AD Connect instance in each forest that syncs with the Entra ID tenant.
2. Install and configure an Intune connector in each forest, linking it to the same Entra ID tenant.
3. Configure each connector to manage devices and users in its respective forest.

Here are some key considerations:

• Each Intune connector will require a separate Azure AD App registration and client ID.
• Each connector will have its own configuration and settings, but they can share the same Entra ID tenant.
• You'll need to ensure that each forest has a unique domain name and that the connectors are configured correctly to manage devices and users in their respective forests.
• You may need to configure additional settings, such as device enrollment and policy management, for each connector.

Windows Autopilot can be used with a multi-forest deployment by configuring each connector to manage devices in its respective forest. You'll need to ensure that each Autopilot device is enrolled with the correct connector and that the device's domain is matched with the correct forest.Yes, it is possible to use multiple Intune connectors on multiple forests and link them to a single Entra ID tenant. This is known as a "multi-forest" or "hybrid" deployment.

When you set up multiple Intune connectors in different forests, each connector will register with the same Entra ID tenant and synchronize with it. You can then configure each connector to manage devices and users in its respective forest.

To achieve this, you'll need to:

1. Set up an Azure AD Connect instance in each forest that syncs with the Entra ID tenant.
2. Install and configure an Intune connector in each forest, linking it to the same Entra ID tenant.
3. Configure each connector to manage devices and users in its respective forest.

Here are some key considerations:

• Each Intune connector will require a separate Azure AD App registration and client ID.
• Each connector will have its own configuration and settings, but they can share the same Entra ID tenant.
• You'll need to ensure that each forest has a unique domain name and that the connectors are configured correctly to manage devices and users in their respective forests.
• You may need to configure additional settings, such as device enrollment and policy management, for each connector.

Windows Autopilot can be used with a multi-forest deployment by configuring each connector to manage devices in its respective forest. You'll need to ensure that each Autopilot device is enrolled with the correct connector and that the device's domain is matched with the correct forest.

Answer 2

Hello @glebgreenspan

I don't know, but i cannot see your answer on the forum, i've received only the notification by mail that you answered, but unfortunatly it doesnt appear here :(

Answer 3

In my Entra tenant, there are two Intune connectors: one from Forest A and another from Forest B. Both forests have a two-way trust relationship, and both domain Intune connectors have full control delegation permissions to create computer objects in any domain.

However:

• When I enroll a device in Forest A, the ODJ blob is directed to the Forest B Intune connector server, resulting in error 80070002, and the enrollment fails.
• Similarly, when enrolling a device in Forest B, the ODJ blob request is directed to the Forest A Intune connector server, which also fails with the same error.
• The enrollment is successful only when the ODJ blob request reaches the correct forest hosting the Intune connector.

Am I missing anything? Any solutions for this?