Alternative System-Level Methods to Retrieve Tenant ID on Intune MDM-Only Enrolled Device

Sivabalan J 20 Reputation points
2026-07-23T05:22:37.72+00:00

I have few machines enrolled in Microsoft Intune using the "Enroll only in device management" enrollment method, and need to retrieve the Tenant ID programmatically for device identification.

I am aware of retrieving the Tenant ID from the user certificate store:
%APPDATA%\Microsoft\SystemCertificates\My\Certificates

Extract the OID 1.2.840.113556.5.14 (tenantId) from the certificate whose thumbprint matches the value of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments{EnrollmentGUID}\dmpCertThumbprint

This approach requires access to a specific user account's certificate store and is not suitable for system-level or service account scenarios.

I am looking for alternative system-level methods to obtain the Tenant ID on a device enrolled in "Enroll only in device management" mode example: Registry keys at HKEY_LOCAL_MACHINE
References:
https://learn.microsoft.com/en-us/answers/questions/5768194/tenant-id-location-for-intune-only-enrolled-device
https://msendpointmgr.com/2024/10/12/unpacking-the-microsoft-intune-mdm-certificate/

Microsoft Security | Intune | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-23T05:22:58.6866667+00:00

    For Intune MDM-only enrollment, the supported local options in the provided material are:

    1. Check the Workplace Join tenant registry location:
      • Open Registry Editor.
      • Go to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\TenantInfo
      • The subkey name under TenantInfo is the tenant ID.
      • If it is not present there, check the same path under: HKEY_LOCAL_MACHINE
    2. Use dsregcmd /status:
      • Run from Command Prompt.
      • Review the User State section.
      • WorkplaceJoined : YES confirms the connected workplace account context.

    There is no official registry path in the provided material that confirms a separate machine-wide Intune MDM-only tenant ID location beyond the Workplace Join paths above.

    For enrollment behavior, Microsoft Entra-integrated MDM enrollment passes the discovery URL from Azure directly to the system, and for a user-owned device where a work account is added, MDM enrollment is not mandatory and can be declined. The enrolled certificate type in that model is a user certificate, not a device certificate. That aligns with why user-context artifacts can appear for this enrollment style instead of a clearly exposed system-wide tenant ID location.

    If a program must run entirely as LocalSystem or a service account, the provided material does not document another supported system-only method to retrieve the tenant ID locally for Intune MDM-only enrollment.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.