Intune Enrollment ASU Discovery is a Windows desktop tool that identifies the Microsoft Intune enrollment routing stamp returned for a tenant.
Enter a tenant domain such as patchmypc.com. The tool automatically creates a synthetic discovery UPN such as foouser@patchmypc.com, sends a SOAP discovery request to the public Microsoft MDM discovery service, and extracts the enrollment front end hostname and ASU stamp from the response.
The tool can also map known ASU aliases to the corresponding Microsoft Intune backend region on a world map.
| Field | Example |
|---|---|
| Tenant domain | contoso.com |
| Discovery UPN | foouser@contoso.com |
| ASU stamp | AMSUA0702 |
| Enrollment hostname | fef.amsua0702.manage.microsoft.com |
| Mapped region | East US 2 |
| Mapped location | United States / Virginia |
| Authentication policy | Federated |
| Enrollment version | 4.0 |
| Activity ID | Correlation identifier returned by the service |
| Response time | Request latency in milliseconds |
| IP addresses | DNS resolution of the returned enrollment host |
- Query one or more tenant domains
- Automatically convert domains into
foouser@domain - Send the Windows MDM discovery SOAP request
- Extract the enrollment policy and enrollment service URLs
- Extract the ASU routing stamp from the returned hostname
- Resolve the enrollment hostname through DNS
- Map known ASU aliases to a Microsoft Intune backend region
- Open a full size world map for the selected result
- Export results to CSV or JSON
- View the raw SOAP response
- Copy the ASU stamp or enrollment hostname
- No Microsoft Graph permissions required
- No tenant sign in required
- No Windows App Runtime dependency
Tenant domain
↓
foouser@tenantdomain
↓
POST to the Microsoft MDM discovery service
↓
DiscoverResult
↓
EnrollmentServiceUrl
↓
fef.<asu>.manage.microsoft.com
↓
Extract ASU stamp
↓
Map known alias to region
The discovery request is sent to:
https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc
The response normally contains values such as:
AuthPolicy
AuthenticationServiceUrl
EnrollmentPolicyServiceUrl
EnrollmentServiceUrl
EnrollmentVersion
ActivityId
The ASU stamp is extracted from the enrollment service hostname.
Example:
https://fef.amsub0102.manage.microsoft.com/StatelessEnrollmentService/DeviceEnrollment.svc
Becomes:
Service role: fef
ASU stamp: AMSUB0102
Mapped region: West Europe
Mapped location: Netherlands / Amsterdam
The result identifies the enrollment front end routing stamp returned by the public MDM discovery service for the supplied tenant domain.
A result such as AMSUB0102 means that the discovery service returned an enrollment endpoint hosted at:
fef.amsub0102.manage.microsoft.com
This is useful when comparing tenant routing during an Intune incident, checking whether several tenants resolve to the same enrollment stamp, or documenting how a tenant is routed during enrollment discovery.
The tool does not prove where every Intune workload for the tenant is physically hosted.
The tool does not list every tenant assigned to an ASU.
The tool does not authenticate to the tenant.
The tool does not enroll a device.
The tool does not request an MDM certificate.
The tool does not call Microsoft Graph.
The world map uses a maintained alias table. If Microsoft returns a new or unknown ASU alias, the tool still shows the discovered ASU and hostname, but the map may show that the alias is not mapped yet.
| Requirement | Value |
|---|---|
| Operating system | Windows 10 or Windows 11 |
| Framework | .NET Framework 4.8 |
| Build environment | Visual Studio 2022 or Visual Studio Build Tools |
| Visual Studio workload | .NET desktop development |
| Administrator rights | Not required |
| Tenant credentials | Not required |
| Internet access | Required |
The tool sends the supplied tenant domain to the public Microsoft MDM discovery endpoint as part of a synthetic UPN.
The tool does not collect passwords, access tokens, refresh tokens, or tenant credentials.
The tool does not upload results to any third party service.
Exports are written only to the location selected by the user.
This project is an independent diagnostic and research tool. It is not an official Microsoft product.
Microsoft Intune, Microsoft Entra, Windows, and Microsoft Graph are trademarks of Microsoft Corporation.
The internal meaning and lifecycle of ASU aliases are not publicly documented as a stable API contract. Microsoft can change endpoint names, routing behavior, SOAP responses, or backend locations without notice.
Add the license that matches how you want the project to be used. MIT is a common option for an open source diagnostic utility.