Microsoft Configuration Manager
GeneralAbout Discovery Methods
In brief
The documentation now states that all discovery methods require the target resource account to be enabled; disabled accounts are filtered during discovery.
What Intune admins need to know
Ensure target resource accounts are enabled so they can be discovered.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- hugowu
- qiani
description: Learn about the available discovery methods to find devices on your network, from Active Directory, or Microsoft Entra ID.
ms.date:
2022-03-23T00:2026-10-29T00:00:00.0000000Z ms.subservice: core-infra ms.topic: concept-article ms.collection: tier3 - To discover a computer resource by using Active Directory system discovery, the discovery agent must be able to resolve the FQDN of the resource. If it can't resolve the FQDN, it then tries to resolve the resource by its NetBIOS name.
- To discover a user or group resource by using Active Directory user discovery or Active Directory group discovery, the discovery agent must be able to resolve the FQDN of the domain controller name that you specify for the Active Directory location.
Note
All discovery methods require the target resource account to be enabled. Disabled accounts are filtered during the discovery.
For each location that you specify, you can configure individual search options, like enabling a recursive search of the location's Active Directory child containers. You can also configure a unique account to use when it searches that location. This account provides flexibility in configuring a discovery method at one site to search multiple Active Directory locations across multiple forests. You don't have to configure a single account that has permissions to all locations.
When each of these three discovery methods runs at a specific site, the Configuration Manager site server at that site contacts the nearest domain controller in the specified Active Directory forest to locate Active Directory resources. The domain and forest can be in any supported Active Directory mode. The account that you assign to each location instance must have Read access permission to the specified Active Directory locations.
@@ -17,7 +17,7 @@ ms.reviewer: - hugowu - qiani description: Learn about the available discovery methods to find devices on your network, from Active Directory, or Microsoft Entra ID.-ms.date: 2022-03-23T00:00:00.0000000Z+ms.date: 2026-10-29T00:00:00.0000000Z ms.subservice: core-infra ms.topic: concept-article ms.collection: tier3@@ -435,6 +435,10 @@ When discovery searches an untrusted forest for resources, the discovery agent m - To discover a computer resource by using Active Directory system discovery, the discovery agent must be able to resolve the FQDN of the resource. If it can't resolve the FQDN, it then tries to resolve the resource by its NetBIOS name.
- To discover a user or group resource by using Active Directory user discovery or Active Directory group discovery, the discovery agent must be able to resolve the FQDN of the domain controller name that you specify for the Active Directory location.
+Note
+
+All discovery methods require the target resource account to be enabled. Disabled accounts are filtered during the discovery.
+
For each location that you specify, you can configure individual search options, like enabling a recursive search of the location's Active Directory child containers. You can also configure a unique account to use when it searches that location. This account provides flexibility in configuring a discovery method at one site to search multiple Active Directory locations across multiple forests. You don't have to configure a single account that has permissions to all locations.
When each of these three discovery methods runs at a specific site, the Configuration Manager site server at that site contacts the nearest domain controller in the specified Active Directory forest to locate Active Directory resources. The domain and forest can be in any supported Active Directory mode. The account that you assign to each location instance must have **Read** access permission to the specified Active Directory locations.