I’ve been integrating Microsoft Defender for Endpoint into our existing device management pipeline, and while the endpoint onboarding for Windows/Linux via automation scripts works flawlessly, the mobile device management (MDM) enrollment portion is consistently failing. Specifically, when attempting to enroll iOS and Android devices through Microsoft Intune (configured as the MDM connector), devices either timeout during the compliance check or never appear in the Defender portal despite successful Intune enrollment.
Our current setup uses:
- Microsoft Defender for Endpoint Plan 1
- Intune standalone (not co-managed)
- Enrollment restrictions configured to allow both platforms
The failure pattern suggests a potential misconfiguration in the connector or a policy sync issue. Has anyone successfully automated this enrollment in a DevOps context? I’m particularly interested in:
* The exact sequence of API calls or PowerShell commands used to validate the MDM connector health.
* Any required conditional access policies that might be blocking the Defender service from seeing the device.
* How you handled the app protection policies (APP) for unmanaged devices if that’s a prerequisite.
I can share our current connector configuration snippet if helpful. The logs from Intune show enrollment success, but the Defender side remains silent—no alerts, no devices listed under “Mobile devices.” This creates a significant gap in our threat visibility.
--crusader
Commit early, deploy often, but always rollback-ready.