Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Updated Connector

30 October 2026RetirementAction required+72 / −68 lines

In brief

The documentation states that Intune Connector for Active Directory versions older than 6.2501.2000.5 are deprecated and can no longer process enrollment requests. It also notes that version 6.2504.2001.8 uses WebView2, removing the need to disable Internet Explorer Enhanced Security Configuration.

What Intune admins need to know

Upgrade connectors older than 6.2501.2000.5 to continue processing enrollments.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Important

The Intune Connector for Active Directory versions older than 6.2501.2000.5 are deprecated and can no longer process enrollment requests. For more information, see the Intune Connector for Active Directory with low-privileged account for Windows Autopilot Hybrid Microsoft Entra join deployments blog post.

To update the connector, you must:

  1. Manually uninstall the legacy connector. There isn't an automatic option.
  2. Download and install the updated connector (describedconnector, as described in this article).article.

Tip

If usingyou use multiple domains to enroll Autopilot devices:

  • You'd need a separate connector instance for each domain. A connector can only process enrollment requests for the same domain as the server it was installed on.
  • There can be at most 1one connector per server (VMserver, whether virtual machine or physical). Additionalphysical. You can set up more servers per domain can be set up for redundancy, each with its own connector installed. In that setup, if one connector fails, the requests will go to another connector on another server withinin the same domain.

Select the tab that corresponds to the version of the Intune Connector for Active Directory that is being installed:you want to install:

Updated Connector

Before you begin

Turn off Internet Explorer Enhanced Security Configuration

Starting with version 6.2504.2001.8, the updated Intune Connector for Active Directory switched to using WebView2, built on Microsoft Edge, instead of WebBrowser, built on Microsoft Internet Explorer. This change means that you no longer need to turn off the Internet Explorer Enhanced Security Configuration setting in Windows Server no longer needs to be turned off.Server. Make sure to install version 6.2504.2001.8 or later of the Intune Connector for Active Directory to avoid issues with the Internet Explorer Enhanced Security Configuration setting.

Download the Intune Connector for Active Directory

  1. On the server where you're installing the Intune Connector for Active Directory is being installed,Directory, sign in to the Microsoft Intune admin center.
  2. In the Home screen, select Devicesin the left hand pane.pane, select Devices.
  3. In the Devices | Overview screen, under By platform, select Windows.
  4. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.
  5. In the Windows | Windows enrollment screen, under Windows Autopilot, select Intune Connector for Active Directory.
  6. In the Intune Connector for Active Directory screen, select Add.
  7. In the Add connector window that opens,window, under Configuring the Intune Connector for Active Directory, select Download the on-premises Intune Connector for Active Directory. The link downloads a file called ODJConnectorBootstrapper.exe.

Install the Intune Connector for Active Directory on the server

Important

TheYou need to install the Intune Connector for Active Directory installation needs to be done with an account that has the following domain rights:

  • Required -: Create msDs-ManagedServiceAccount objects in the Managed Service Accounts container.
  • Optional -: Modify permissions in OUs in Active Directory - ifDirectory. If the administrator installingwho installs the updated Intune Connector for Active Directory doesn't have this right, additional configuration steps are required by an administrator who has these rights.rights needs to perform additional configuration steps. For more information, see the step/section Increase the computer account limit in the Organizational Unit.

  1. Sign in to the server where you're installing the Intune Connector for Active Directory is being installed with an account that has local administrator rights.

  2. If the previous legacy Intune Connector for Active Directory is installed, uninstall it first before installingyou install the updated Intune Connector for Active Directory. For more information, see Uninstall the Intune Connector for Active Directory.

    Important

    When uninstallingyou uninstall the previous legacy Intune Connector for Active Directory, make sure toensure you run the legacy Intune Connector for Active Directory installer as part of the uninstall process. If the legacy Intune Connector for Active Directory installer prompts to Uninstall it when it's run, runs, select to uninstall it. This step ensures that the previous legacy Intune Connector for Active Directory is fully uninstalled. TheYou can download the legacy Intune Connector for Active Directory installer can be downloaded from Intune Connector for Active Directory.

    Tip

    In domains with only a single Intune Connector for Active Directory, Microsoft recommends first installing the updated Intune Connector for Active Directory on another server. InstallingYou should install the updated Intune Connector for Active Directory on another server should be done before uninstallingyou uninstall the legacy Intune Connector for Active Directory on the current server. InstallingBy installing the Intune Connector for Active Directory on another first avoidsserver first, you avoid any downtime while the Intune Connector for Active Directory is being updatedupdating on the current server.

  3. Open the ODJConnectorBootstrapper.exe file that you downloaded to launch the Intune Connector for Active Directory Setup install.

  4. Step through the Intune Connector for Active Directory Setup install.

  5. At the end of the install, select the checkbox Launch Intune Connector for Active Directory.

    Note

    If you accidentally close Intune Connector for Active Directory Setup install is accidentally closed without selecting the checkbox Launch Intune Connector for Active Directory, you can reopen the Intune Connector for Active Directory configuration can be reopened by selecting Intune Connector for Active Directory > Intune Connector for Active Directory from the Start menu.

Sign in to the Intune Connector for Active Directory

  1. In the Intune Connector for Active Directory window,, under the Enrollment tab, select Sign In.

  2. UnderIn the Sign In tab, sign in with the Microsoft Entra ID credentials of an Intune administrator role. The user account must have an assigned Intune license. The sign in process might take a few minutes to complete.

    Note

    The account usedyou use to enroll the Intune Connector for Active Directory is only a temporary requirement at the time of installation. The account isn't used going forward after the server is enrolled.

  3. OnceAfter the sign in process completes:

    1. The Intune Connector for Active Directory successfully enrolled confirmation window appears. Select OK to close the window.
    2. A Managed Service Account with name "<MSA_name>" was successfully set up confirmation window appears. The name of the MSA is in the format msaODJ#####, where ##### are five random characters. NotateNote the name of the MSA that was created, and then select OK to close the window. TheYou might need the name of the MSA might be needed later to configure the MSA to allow creating computer objects in OUs.

  4. The Enrollment tab shows Intune Connector for Active Directory is enrolled. The Sign In button is greyed out and Configure Managed Service Account is enabled.

  5. Close the Intune Connector for Active Directory window.

Verify the Intune Connector for Active Directory is active

After authenticating,you authenticate, the Intune Connector for Active Directory finishes installing. Once it finishes installing,When the installation finishes, verify that it's active in Intune by following these steps:

  1. Go to the Microsoft Intune admin center if it's still open. If the Add connector window is still displayed, close it.

    If the Microsoft Intune admin center isn't still open:

    1. Sign in to the Microsoft Intune admin center.
    2. In the Home screen, select Devicesin the left hand pane.pane, select Devices.
    3. In the Devices | Overview screen, under By platform, select Windows.
    4. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.
    5. In the Windows | Windows enrollment screen, under Windows Autopilot, select Intune Connector for Active Directory.

  2. In the Intune Connector for Active Directory page:

    • Confirm that the server is displayed under Connector name and shows as Active under Status.
    • For the updated Intune Connector for Active Directory, make sure the version is greater than or equal to 6.2501.2000.5.

    If the server isn't displayed, select Refresh or navigate away from the page, and then navigatego back to the Intune Connector for Active Directory page.

Note

  • It can take several minutes for the newly enrolled server to appear in the Intune Connector for Active Directory page of the Microsoft Intune admin center. The enrolled server only appears if it can successfully communicate with the Intune service.
  • Inactive Intune Connectors for Active Directory still appear in the Intune Connector for Active Directory page and willis automatically be cleaned up after 30 days.

After you install the Intune Connector for Active Directory is installed,Directory, it will startstarts logging in the Event Viewer under the path Applications and Services Logs > Microsoft > Intune > ODJConnectorService. Under this path, you can find Admin and Operational logs can be found.logs.

Configure the MSA to allow creating objects in OUs (optional)

By default, MSAs only have access to create computer objects in the Computers container. MSAs don't have access to create computer objects in Organizational Units (OUs). To allow the MSA to create objects in OUs, the OUsyou need to be addedadd the OUs to the ODJConnectorEnrollmentWizard.exe.config XML file found in ODJConnectorEnrollmentWizard directory where theyou installed Intune Connector for Active Directory was installed,Directory, normally C:\Program Files\Microsoft Intune\ODJConnector\.

To configure the MSA to allow creating objects in OUs, follow these steps:

  1. On the server where the Intune Connector for Active Directory is installed, navigate to the ODJConnectorEnrollmentWizard directory where the Intune Connector for Active Directory wasis installed, normally C:\Program Files\Microsoft Intune\ODJConnector\.

  2. In the ODJConnectorEnrollmentWizard directory, open the existing ODJConnectorEnrollmentWizard.exe.config XML file in a text editor, for example,such as Notepad.

  3. In the add key element of the ODJConnectorEnrollmentWizard.exe.config XML file:

    • Next to value=, add in any desired OUs that the MSA should have access to create computer objects in.
    • The OU name needs to be in the LDAP distinguished name format and if applicable, needs to be escaped.
    • MultipleSeparate multiple OUs are supported by separating each OU with a semicolon (;).
    • Make sure to retainRetain the quotes (") next to value=. All of the OU values need to be withinin one pair of quotes.
    • Don't change the name of the key element OrganizationalUnitsUsedForOfflineDomainJoin.

    The following example is an example XML entry with multiple OUs in LDAP distinguished name format:

    Tip

    In the following example, replace the example red text next to value= with theyour organization's OUs in LDAP distinguished name format. As shown in the example, make sureensure all OU entries are within the quotes (") and that each OU is separated with a semicolon (;).

  4. OnceAfter you add all desired OUs are added,OUs, save the ODJConnectorEnrollmentWizard.exe.config XML file.

  5. As an administrator that haswith appropriate permissions to modify OU permissions, open the Intune Connector for Active Directory by navigatinggoing to Intune Connector for Active Directory > Intune Connector for Active Directory from the Start menu.

    Important

    If the administrator installing and configuring the Intune Connector for Active Directory doesn't have permissions to modify OU permissions, thenan administrator who has permissions to modify OU permissions needs to follow the section/steps in Increase the computer account limit in the Organizational Unit need to be followed instead by an administrator that does have permissions to modify OU permissions..

  6. UnderIn the Enrollment tab in the Intune Connector for Active Directory window, select Configure Managed Service Account.

  7. An A Managed Service Account with name "<MSA_name>" was successfully set up confirmation window appears. Select OK to close the window.

Use a custom Managed Service Account (optional)

- If using sMSA, the account can only be linked to a single machine.
- If using a gMSA, the server you’re installing the gMSA on needs to have access to the password.
How to set up
Disable OU updates

UsingIf you use your own MSA will disableMSA, the connector from makingdoesn't make any OU updates, regardless of any configured in OrganizationalUnitsUsedForOfflineDomainJoin.even if you configure OrganizationalUnitsUsedForOfflineDomainJoin. To prevent errors, disable OU updates by updating ODJConnectorEnrollmentWizard.exe.config. ItsThe default location is C:\Program Files\Microsoft Intune\ODJConnector\ODJConnectorEnrollmentWizard.

  1. In the appSettings section of the file, add the following line:

Legacy Connector

Important

The legacy Intune Connector for Active Directory is deprecated. These instructions assume that the legacy Intune Connector for Active Directory is already installed or is already downloaded. If you don't have the legacy Intune Connector for Active Directory installer isn't already downloaded,installer, you can download it can be downloaded from Intune Connector for Active Directory.

However, best practice is to download and install the updated Intune Connector for Active Directory. For more information, select the Updated Connector tab instead.

Before beginningyou begin the installation, make sure that you meet all of the Intune connector for Active Directory server requirements are met..

Disable Internet Explorer Enhanced Security Configuration

By defaultdefault, Windows Server has Internet Explorer Enhanced Security Configuration turned on. Internet Explorer Enhanced Security Configuration might cause problems signing in to the Intune Connector for Active Directory. SinceBecause Internet Explorer is deprecated and in most instances, not even installed on Windows Server, Microsoft recommends turning off Internet Explorer Enhanced Security Configuration. To turn off Internet Explorer Enhanced Security Configuration:

  1. Sign in to the server where you're installing the Intune Connector for Active Directory is being installed with an account that has local administrator rights and domain admin rights. DomainYou need domain admin rights are required so that the Intune Connector for Active Directory installer can properly create an MSA.

  2. Open Server Manager.

  3. In the left pane of Server Manager, select Local Server.

  4. In the right PROPERTIES pane of Server Manager, select the On or Off link next to IE Enhanced Security Configuration.

    Note

    If anyou want to install in a location other than the default of C:\Program Files\Microsoft Intune\ODJConnector is desired,, select Options and specify the desired install location.

  5. When the install completes,finishes, select Configure Now in the Intune Connector for Active Directory Setup installer window.

    Note

    If you accidentally select Close is accidentally selected or close the Intune Connector for Active Directory Setup installer window is accidentally closed,window, you can access the Intune Connector for Active Directory configuration can be accessed by selecting Intune Connector for Active Directory > Intune Connector for Active Directory from the Start menu.

Sign in to the legacy Intune Connector

  1. In the Intune Connector for Active Directory window, under the Enrollment tab,, select Sign In.

  2. UnderIn the Sign In tab, sign in with the credentials of an Intune administrator role. The user account must have an assigned Intune license. The sign in process might take a few minutes to complete.

    Note

    The account used to enroll the Intune Connector for Active Directory is only a temporary requirement at the time of installation. The account isn't used going forward after the server is enrolled.

  3. Once theAfter you sign in process is complete,in, a The Intune Connector for Active Directory successfully enrolled confirmation window appears. Select OK to close the window.

  4. The Enrollment tab shows Intune Connector for Active Directory is enrolled and the Sign In button is greyed out.

  5. Close the Intune Connector for Active Directory window.

Verify the legacy Intune Connector for Active Directory is active

After authenticating, the Intune Connector for Active Directory finishes installing. OnceAfter it finishes installing, verify that it's active in Intune by following these steps:

  1. Go to the Microsoft Intune admin center if it's still open. If the Add connector window is still displayed, close it.

    If the Microsoft Intune admin center isn't still open:

    1. Sign in to the Microsoft Intune admin center.
    2. In the Home screen, select Devicesin the left hand pane.pane, select Devices.
    3. In the Devices | Overview screen, under By platform, select Windows.
    4. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.
    5. In the Windows | Windows enrollment screen, under Windows Autopilot, select Intune Connector for Active Directory.

  2. In the Intune Connector for Active Directory page, confirm that the server is displayed under Connector name and shows as Active under Status. If the server isn't displayed, select Refresh or navigate away from the page, and then navigatego back to the Intune Connector for Active Directory page.

Note

  • It can take several minutes for the newly enrolled server to appear in the Intune Connector for Active Directory page of the Microsoft Intune admin center. The enrolled server only appears if it can successfully communicate with the Intune service.
  • Inactive Intune Connectors for Active Directory still appear in the Intune Connector for Active Directory page and willare automatically be cleaned up after 30 days.

After the Intune Connector for Active Directory is installed, it will startstarts logging in the Event Viewer under the path Applications and Services Logs > Microsoft > Intune > ODJConnectorService. Under this path, you can find Admin and Operational logs can be found.logs.

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…