Duplicate AAD Device, 1 for MDM (Intune) and the other is the joined device (not Hybrid joined)

Question

Hi all.
I've been looking into how Intune and AAD interact after an Intune device is deleted.
This is my test/setup.

I created an normal Windows 11 VM in Azure via the portal, this is enabled for logon using AAD (AADLogonForWindows VM extension) using the check for Entra ID on the management tab (I think) , I did not mark this device to be Intune enrolled at the time of creation (this was deliberate).

As expected the device in AAD was created for the new VM, Entra ID Joined.

From an RDP session on to the TestingVM I enrolled it into Intune (Settings > Accounts > Enrol).
As expected a device was created in Intune for the new VM (as personal, but that doesn't matter).

Upon checking in Entra ID devices there are now two devices, as follows;

• TestingVM
  • Join Type: Microsoft Entra Joined
  • MDM: None
• TestingVM
  • Join Type: <Blank>
  • MDM: Microsoft Intune

My questions are:

1. Will these two object merge at some point, if so, when?
2. If not, if there a away to merge them?
3. Why were two object created?

My aim is to be able to have a single AAD device object that is both Entra joined and Intune enrolled without having to destroy and recreate the VM (I'm planning for when someone incorrectly deletes an Intune device object!).

Answer 1

@Jonathan Telling, Thanks for posting in Q&A.

Q1. Will these two object merge at some point, if so, when?

A1. Typically, these objects do not automatically merge. The creation of two separate objects happens because the device was initially Azure AD joined and then later enrolled into Intune, creating a separate entry for the Intune enrollment.

Q2. If not, if there a way to merge them?

A2. Unfortunately, there isn't a direct way to merge these objects manually. However, you can try removing the device from Azure AD and Intune, then re-enrolling it.

Q3. Why were two objects created?

A3. Two objects were created because the device was first Azure AD joined and then enrolled into Intune. This results in separate entries for each action: one for the Azure AD join and another for the Intune enrollment

To achieve your goal, you can remove the device from both Azure AD and Intune and try to re-enroll the device into Intune directly from the device settings. This should create a single object that is both Azure AD joined, and Intune enrolled.

If someone incorrectly deletes an Intune device object, you can re-enroll the device into Intune without needing to recreate the VM.

https://call4cloud.nl/2020/05/intune-auto-mdm-enrollment-for-devices-already-azure-ad-joined/

Non-official, just for reference.

Hope above information can help you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.