--- title: "Device Enrollment Manager - Enrolling a Device in Microsoft Intune" slug: "device-enrollment-manager-enrolling-a-device-in-microsoft-intune" description: "How to Enroll a Device in Microsoft Intune for use with RapidIdentity" tags: ["How To", "Device Enrollment Manager", "RapidIdentity ", "Microsoft", "Intune"] updated: 2022-10-31T17:14:35Z published: 2022-10-31T17:14:35Z canonical: "help.rapididentity.com/device-enrollment-manager-enrolling-a-device-in-microsoft-intune" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt > Use this file to discover all available pages before exploring further. # Device Enrollment Manager - Enrolling a Device in Microsoft Intune ## Device Enrollment Manager - Enrolling a device in Microsoft Intune The **Device Enrollment Manager** (DEM) is a kind of service account. These accounts have permissions that let authorized users enroll and manage multiple corporate-owned devices. A DEM account requires an Intune user or device license, and an associated Azure AD user. DEM is an Intune role/permission that can be applied to an Azure AD user account, and they can enroll up to 1000 devices. A DEM account is useful for scenarios where devices are enrolled & prepared before handing them out to the users of the devices. There’s a limit of 150 Device Enrollment Manager accounts in Microsoft Intune. DEM enrolls Windows 10/11 devices. 1. [Pre-requisite to create DEM accounts](/v1/docs/device-enrollment-manager-enrolling-a-device-in-microsoft-intune#1-prerequisite-to-create-dem-accounts) 2. [Add a device enrollment manager](/v1/docs/device-enrollment-manager-enrolling-a-device-in-microsoft-intune#2-add-a-device-enrollment-manager) 3. [Enrolling a device in Microsoft Intune](/v1/docs/device-enrollment-manager-enrolling-a-device-in-microsoft-intune#3enrolling-a-device-in-microsoft-intune) 4. [To remove a device enrollment manager user](/v1/docs/device-enrollment-manager-enrolling-a-device-in-microsoft-intune#4to-remove-a-device-enrollment-manager-user) ### ****1. Prerequisite to create DEM accounts**** Global Administrator or Intune Administrator. An Azure AD user with the above-mentioned role can perform the following tasks: - Assign DEM permission to an Azure AD user account - See all DEM users ### ****2. Add a device enrollment manager**** 1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and choose **Devices** > **Enroll devices** > **Device enrollment managers**. 2. Select **Add**. 3. On the **Add User**, enter a user principal name for the DEM user, and select **Add**. The DEM user is added to the list of DEM users. ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-qpn3k42q.png) 4. User added as a DEM has Intune license: ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-htkm2k4p.png) ### ****3. Enrolling a device in Microsoft Intune**** Now Switch to your Windows 10 machine to enroll a device 1. Right-click on **Windows > Settings > Accounts** 2. Access Work or School Account and then click **Connect.**![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-63azr1ht.png) 3. Click on **Join this device to Azure AD Directory** and add DEM user credentials and click on Next and **Sign In.**![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-18tnxej4.png) 4. Click on **Join** and then click on **Done**.![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-hiuoko0y.png) 5. In the next window, the DEM user is connected to Azure AD. ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-8pfu04xw.png) 6. Now restart the machine with the same user. 7. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and choose **Devices** > **All devices**. You will see your device enrolled and managed by Intune.![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-c5c84hkh.png) 8. Once the device is enrolled, follow this link to deploy MSI to Intune managed device: [Deployment of MSI packages through Microsoft Intune](/v1/docs/deployment-of-msi-packages-through-microsoft-intune) **Only the Intune admin has the capability to perform a wipe or remove any enrolled device and that is through the Microsoft Endpoint Manager admin center only.** ### ****4. To remove a device enrollment manager user**** 1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and choose **Devices** > **Enroll devices** > **Device enrollment managers**. 2. On **Device enrollment managers**, select the DEM user and select **Delete**. ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/device-enrollment-manager---enrolling-a-device-in-microsoft-intune-image-w84edm4a.png) [How to deploy the MSI package to an enrolled device through Microsoft Intune.](/v1/docs/deployment-of-msi-packages-through-microsoft-intune) ## Related - [RapidIdentity Mobile App for Mobile Users Only](/mobile-app-for-mobile-users-only.md) - [Enrolling Mobile App Authentication](/mobile-app-authentication.md) - [Installation](/installation.md) - [Deploy MSI Installer for Windows Authentication with Windows Group Policy Object (GPO)](/deploy-msi-installer-for-windows-authentication-with-windows-group-policy-object-gpo.md)