Not all devices in Zero Touch Portal are forcing a fully managed profile.

Hi Nancy,

Devices marked als personal in Intune are not enrolled via zero touch, If they should have been then there is something wrong in your configuration or devices did not have an active internet connection when the first configuration was done. 

When using the Google / Android zero touch portal via Intune, I advice you to stay away from the Zero touch bulk menu option in the Android enrollment page of Intune. It has caused me more headaches then I wish for. When using this portal, I make sure it is not connected to the Intune tenant and create a manual configuration profile myself in Android zero touch. 

Configuring that is described here (be carefull, this links to the correct steps direclty. Do not scroll up or you will follow the instructions for the part i advice you to ignore): https://learn.microsoft.com/en-us/mem/intune/enrollment/android-dedicated-devices-fully-managed-enroll#create-configuration-in-zero-touch-enrollment-portal

High level, these items should be configured properly:

• Devices should be listed in Android / Google zero touch
• A profile, or multiple, should have been created in Google zero touch
  • Profile contains a token which corresponds with the enrollment profile token in Intune (one of 4 management profiles)
• Device must have a profile assigned
• Device must be connected to internet when starting the initial setup

this will make sure a device is enrolled as corporate in Intune. Make sure to use filters or groups with users to give it the policies needed.