Whether you manually add users or synchronize from your on-premises Active Directory, you must first assign each user an Intune license before users can enroll their devices in Intune.
You can use the Microsoft Admin to manually add cloud-based users and assign licenses to both cloud-based user accounts and accounts synchronized from your on-premises Active Directory to Azure AD.
- In the Microsoft Admin, select Users > All Users > choose a user > Licenses > Assignments.
- Choose the box for Intune and Enterprise Mobility + Security E5 > Save.
The user account now has the permissions needed to use the service and enroll devices into management.