Hi, K-12 admin here. We are well on our way into autoenrolling our Active Directory devices in Intune via the Hybrid Azure AD Join process. Users are able to enroll their devices, policies are getting applied, and all seems well with the setup. However, I noticed an issue yesterday. We have shared Surface tablets for some of our student groups. There is a generic AD account used to sign into these shared devices. This account is not licensed in any form in M365, however, this account is mistakenly getting synched to Azure AD. Now, once this AD account is signed in to these devices - which are also synced to Azure AD - they are getting enrolled into InTune.I cannot do InTune device licensing at this moment.
Our Mobility scope to enroll is set to All, as I thought it was the licensing that controlled what would get enrolled to InTune....