Troubleshooting Intune Enrollment for Existing AVD Multi-Session Hosts

[u/MainNimbus]

Hello everyone,

I wanted to share a challenge I’ve encountered while managing Azure Virtual Desktop (AVD) multi-session hosts and their enrollment into Microsoft Intune—specifically when dealing with existing VMs that were provisioned previously, around 2023.

Background

My environment uses Hybrid Azure AD Join and is configured with a Group Policy Object (GPO) to trigger automatic Intune MDM enrollment. This setup works flawlessly when deploying new AVD hosts—they automatically join Entra ID and enroll into Intune as expected.

The Issue with Existing AVDs

The problem arises when I attempt to enroll existing AVD hosts into Intune. These are machines that are: • Domain-joined (on-prem) • Synchronized with Entra ID (Azure AD) • Already configured and in use—so redeployment is not an option

Out of several existing AVDs, I’ve successfully managed to enroll three without any issues. However, the rest are failing to enroll, despite appearing correctly joined.

Troubleshooting So Far

Here’s what I’ve tried: • Verified join status using dsregcmd /status: • AzureAdJoined = YES • DomainJoined = YES • Everything else looks normal • Forced Group Policy update using gpupdate /force — no signs of enrollment initiation • Attempted re-enrollment using PowerShell

• Tried leaving and rejoining Hybrid Azure AD — no effect

Despite these steps, many of the existing AVDs still fail to initiate Intune enrollment. All devices are visible in Entra ID and also present in on-prem AD.

I’m aware that cloning or imaging can cause issues with token and certificate duplication. However, these VMs were not deployed from enrolled images, and Intune token roaming is not in use. So that shouldn’t be the issue here.

If anyone has run into this situation—especially with legacy AVD multi-session VMs and Intune MDM auto-enrollment via GPO—I’d appreciate your insight. Is there a step I’m missing? Could certificates or registry remnants be causing this? Should I be cleaning something manually?

Thanks an advance!!

[u/Rudyooms]

Well, when you mention: Provisioned previously... --> that means a old intune/mdm enrollment/registration could still be on the device and is blocking the new enrollment.

Take a look at this page and specifically 5.5 --> to delete the old enrollment first....
Intune Device Enrollment errors | MDM enrollment issues

Also take a look at the device management enterprise event log... it could show you where to start digging to fix your issue