Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Legacy Connector

30 October 2026Doc update+25 / −25 lines

In brief

The tutorial received editorial and metadata updates, including clearer wording, corrected grammar, and refined instructions for granting the MSA permission to create computer objects.

What Intune admins need to know

Administrators following the tutorial should find the Intune Connector and Active Directory permission steps easier to understand.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This step is only needed under one of the following conditions:

The purpose of Intune Connector for Active Directory is to join computers to a domain and add them to an OU. For this reason, the Managed Service Account being used for the Intune Connector for Active Directory needs to have permissions to create computer accounts in the OU where the computers are joined to the on-premises domain.

With default permissions in Active Directory, domain joins by the Intune Connector for Active Directory might initially work without any permission modifications to the OU in Active Directory. However afterAfter MSA attempts to join more than 10 computers to the on-premises domain, it would stop working becausebecause, by default, Active Directory only allows any single account to join up to 10 computers to the on-premises domain.

The following users aren't restricted by the 10 computer domain join limitation:

  • The administrator installing the Intune Connector for Active Directory has the necessary permissions to set permissions on the OUs.
  • The administrator configuring the Intune Connector for Active Directory has the necessary permissions to set permissions on the OUs.

If the administrator installingwho installs or configuringconfigures the Intune Connector for Active Directory doesn't have the necessary permissions to set permissions on the OUs, then use the following steps need to be followed:steps:

  1. Sign in to a computer that has access to the Active Directory Users and Computers console with an account that ashas the necessary permissions to set permissions on OUs.

  2. Open the Active Directory Users and Computers console by running DSA.msc.

  3. Expand the desired domain and navigate to the organizational unit (OU) that computers are joiningjoin to during Windows Autopilot.

    Note

    TheYou specify the OU that computers join during the Windows Autopilot deployment is specified later duringin the Configure and assign domain join profile step.

  4. Right-click on the OU and select Properties.

    Note

    If computers are joining the default Computers container instead of an OU, right-click on the Computers container and select Delegate Control.

  5. In the OU Properties windows that opens,windows, select the Security tab.

  6. In the Security tab, select Advanced.

  7. In the Advanced Security Settings window, select Add.

  8. In the Permission Entry windows, next to Principal, select the Select a principal link.

  9. In the Select User, Computer, Service Account, or Group window, select the Object Types... button.

  10. In the Object Types window, select the Service Accounts check box,, and then select OK.

  11. In the Select User, Computer, Service Account, or Group window, under Enter the object name to select, enter the name of the MSA being used for the Intune Connector for Active Directory.

    Tip

    The MSA was created during the Install the Intune Connector for Active Directory step/section andsection. It has the name format of msaODJ#####, where ##### are five random characters. If you don't know the MSA name isn't known,name, follow these steps to find the MSA name:it:

    1. On the server runningthat runs the Intune Connector for Active Directory, right-click on the Start menu and then select Computer Management.
    2. In the Computer Management window, expand Services and Applications and then select Services.
    3. In the results pane, locate the service with the name Intune ODJConnector for Active Service. The name of the MSA is listed in the Log On As column.

  12. Select Check Names to validate the MSA name entry. OnceAfter the entry is validated,validates, select OK.

  13. In the Permission Entry windows, select the Applies to: drop-down menu and then select This object only.

  14. Under Permissions, unselectclear all items, and then only select theonly Create Computer objects check box..

  15. Select OK to close the Permission Entry window.

  16. In the Advanced Security Settings window, select either Apply or OK to apply the changes.

Legacy Connector

The purpose of Intune Connector for Active Directory is to join computers to a domain and add them to an OU. For this reason, the server running the Intune Connector for Active Directory needs to have permissions to create computer accounts in the OU where the computers are joined to the on-premises domain.

With default permissions in Active Directory, domain joins by the Intune Connector for Active Directory might initially work without any permission modifications to the OU in Active Directory. However afterAfter the server runningthat runs the Intune Connector for Active Directory attempts to join more than 10 computers to the on-premises domain, it would stopstops working because by default, Active Directory only allows any single account to join up to 10 computers to the on-premises domain.

The following users aren't restricted by the 10 computer domain join limitation:

  • Users in the Administrators or Domain Administrators groups -groups: in order to comply with the least privilege principles model, Microsoft doesn't recommend making the computer account runningthat runs the Intune Connector for Active Directory an administrator or domain administrator.
  • Users with delegated permissions on Organizational Unit (OUs) and containers in Active Directory to create computer accounts -accounts: this method is recommended sincebecause it follows the least privilege principles model.

To fix this limitation, the server running the Intune Connector for Active Directory needs the Create computer accounts permission in the Organizational Unit (OU) where the computers are joined to in the on-premises domain:domain

To increase the computer account limit in the Organizational Unit (OU) that computers are joining to during Windows Autopilot, follow these steps on a computer that has access to the Active Directory Users and Computers console:

  1. In the Welcome to the Delegation of Control Wizard window of the Delegation of Control Wizard, select Next.

  2. In the Users or Groups window, under Selected users and groups, select Add.

  3. Next to Select this object type: in the Select Users, Computers, or Groups window, select Object Types.

  4. In the Object Types window, select the Computers check box,, and then select OK. TheLeave the other items in this window can be left at their default.

  5. In the Select Users, Computers, or Groups window, under the Enter the object names to select box,, enter the name of the computer where you installed the Intune Connector for Active Directory was installed during the Install the Intune Connector for Active Directory step.

  6. Select Check Names to validate the entry. OnceAfter the entry is validated,validates, select OK.

  7. In the Users or Groups window, verify that the correct computer is shown under Selected users and groups:, and then select Next.

  8. In the Tasks to Delegate window, select Create a custom task to delegate, and then select Next.

  9. In the Active Directory Object Type window:

    1. Under Only the following objects in the folder, select Computer objects.
    2. Select the Create selected objects in this folder checkbox.
    3. Select Next.

  10. In the Permissions window, under Permissions:, select the Full Control check box,, and then select Next.

    Note

    After selecting the Full Control check box,checkbox, all other options under Permissions: are automatically selected. TheThis automatic selection of the checkboxes is normal and expected. Don't unselect any of the check boxescheckboxes after they're automatically selected.

  11. In the Completing the Delegation of Control Wizard window,, select Finish.

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…