Device Enrollment Mananger

If I not mistaking. Device enrollment managers are useful when you need to enroll and prepare many devices for distribution. People signed in to a DEM account can enroll and manage up to 1,000 devices (Intune Device Limits), while a standard non-admin account can only enroll 15.

It is important to note that a DEM account requires an Intune user or device license, and an associated Azure AD user. Global Administrators and Intune Service Administrators can add and manage device enrollment managers in the Microsoft Intune admin center.

However, there are some limitations and according to Microsoft,

"Applying an Entra ID maximum device limit of less than 1,000 to a DEM account will prevent you from reaching the 1,000 device limit that the DEM account can enroll."

That makes perfect sense, because the default limit for users to join in Azure AD is the recommended value of 20.

The 1,000-device limit applies only to Intune’s own device enrollment cap for a Device Enrollment Manager (DEM) account. The error being seen is almost certainly coming from a different limit: the Microsoft Entra ID “maximum number of devices per user” setting.

Key points from the documented behavior:

1. A DEM account can enroll up to 1,000 devices in Intune.
2. Separately, Microsoft Entra ID has its own per-user device join/registration limit. This is configured in Microsoft Entra admin center under Identity > Devices > Device settings > Maximum number of devices per user.
3. For DEM scenarios, there is an explicit note that applying a Microsoft Entra maximum device limit of less than 1,000 to a DEM account prevents reaching the 1,000 Intune DEM limit.
4. The “DeviceCapReached” error (or similar “too many devices” message) is the standard symptom when a user hits a device limit.

Because the DEM has only 178 Intune-enrolled devices, the most likely cause is that the Microsoft Entra device limit for that user is set to a value at or below the number of devices already joined/registered in Entra (which may include devices beyond those visible as Intune-enrolled).

Recommended checks and fix:

1. Check Intune device limit restrictions:
   • In Microsoft Intune admin center go to Devices > Enrollment restrictions > Device limit restrictions and confirm that the DEM user is not constrained by an Intune device limit policy (DEM accounts are normally used to avoid this, but confirm the policy scope).
2. Check Microsoft Entra device limit for the tenant:
   • In Microsoft Entra admin center, go to Identity > Devices > Device settings.
   • Review Maximum number of devices per user.
   • If this value is less than 1,000, it can block the DEM from reaching the Intune DEM limit. If appropriate for the organization, increase this value (for example, to 1,000) so the DEM can continue to join/register devices.
3. Check how many Entra devices the DEM already has:
   • In Intune admin center, go to Users > All users > [DEM user] > Devices and note the number of devices.
   • Also review the DEM’s devices in Microsoft Entra admin center > Identity > Users > [DEM user] > Devices to see all joined/registered devices.
4. Clean up stale devices if needed:
   • If the DEM is at or near the Entra device limit, remove stale or unused device records before enrolling more devices.

Once the Microsoft Entra device limit is raised (or stale devices are removed), the DEM should be able to enroll additional devices up to the Intune DEM limit of 1,000.

References:

• Add device enrollment managers
• Understand Intune and Microsoft Entra device limit restrictions
• Troubleshooting device enrollment in Intune
• Mobile device enrollment
• Step 5 – Enroll devices in Microsoft Intune
• Configure enrollment restrictions