Windows MDM CNAME Discovery: January 2027 Change

Microsoft’s 15 October announcement says that support for CNAME-based autodiscovery in Windows MDM-only enrolment will end starting 15 January 2027.

The useful preparation is to find the workflows that depend on that discovery step and update their instructions. The announcement does not retire MDM-only enrolment itself or require existing enrolled devices to enrol again.

Identify the affected combination

The change concerns a Windows MDM-only workflow that uses an EnterpriseEnrollment DNS CNAME and relies on that record to discover the management endpoint.

Check all three parts. The presence of an EnterpriseEnrollment record alone does not prove that current onboarding uses it. A device listed in Intune also does not reveal which discovery route the person followed when enrolling.

Microsoft’s Windows enrolment guidance distinguishes joining Entra, registering a work account and enrolling only in device management. Use that distinction when interviewing the helpdesk or reading old onboarding pages.

Ask someone to demonstrate the actual supported journey on a suitable test device. Record the starting Windows state, selected option, user identity and endpoint prompt.

Build a workflow inventory

Keep the inventory small and useful:

Include each relevant sign-in domain. An organisation can have several domains and several versions of the onboarding guide.

Mark a workflow “unconfirmed” if no one can demonstrate it. Do not turn a missing owner into an assumption that the process is unused. Check recent support activity and ask the team responsible for new starters or replacement devices.

The older Intune autodiscovery documentation explains how the DNS alias removes the need to enter a server address. Read that background alongside the newer dated announcement when planning the affected workflow.

Put the server address into the right instruction

For an affected experience that does not already supply the endpoint, Microsoft says users will need to enter:

https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

Put the address in the approved onboarding page with a clear explanation of when it is needed. Avoid asking users to search the web for an enrolment server during setup.

Keep the distinction between discovery and authentication visible to support staff. Entering the endpoint does not remove the need for an authorised account, an appropriate enrolment policy or any required authentication.

Use the announced commercial-service URL in the relevant commercial Intune workflow. Organisations operating in another cloud should confirm their applicable service guidance rather than copying an endpoint from an unrelated environment.

Avoid a broad DNS cleanup

Existing enrolled devices are unaffected by this announced discovery change. Entra join and hybrid-join flows that do not depend on the affected CNAME mechanism are also outside its stated scope.

Do not delete EnterpriseEnrollment records simply because the announcement mentions them. First establish other uses and the intended replacement for each affected process. Keep EnterpriseRegistration separate: the similar name does not make it the same record or function.

Have the DNS owner review any proposed change with the device-enrolment owner. A record’s apparent age is not evidence that it is safe to remove.

Test the revised journey

Have a support operator follow the updated instructions without relying on undocumented knowledge. Confirm that they can recognise the endpoint prompt, enter the correct address, complete enrolment and find the resulting managed device.

Record both the user-facing result and a management check-in. The acceptance test should also include a harmless policy or application assigned to the test device, so completion means more than reaching the end of a wizard.

An October test can establish that the explicit-endpoint route works. It cannot prove the future service behaviour after the January change has taken effect. Schedule a follow-up check of an affected workflow after the change begins.

Give each onboarding page and partner instruction a named owner. Finish preparation when the affected routes have an agreed replacement, the instructions have been exercised, and the helpdesk knows how to distinguish a discovery prompt from an authentication failure.

References

• Microsoft — Preparing for end of support for CNAME autodiscovery in Windows MDM-only enrolment. Accessed 17 October 2026.
• Microsoft — MDM enrolment of Windows devices. Accessed 17 October 2026.
• Microsoft — Intune enrolment-server autodiscovery. Accessed 17 October 2026.