Fully managed (COBO) and corporate-owned work profile (COPE) devices enroll during Android setup, before anyone can use them. When something breaks, the user sees a generic Android error, a blocked sign-in or a registration screen that never finishes. In this post I'll walk through the enrollment chain (device, token, provisioning method, Google downloads, Microsoft Entra sign-in and registration) and show how to find the broken link and prove the fix.
Errors this guide fixes
Couldn't set up your device. For help, contact your IT admin.Android setup screenAADSTS53000 (DeviceNotCompliant)Microsoft Entra sign-in log+1 more guideSomething went wrongMicrosoft Intune app (device registration)
Symptoms#
- Straight after scanning the QR code, typing the token or the NFC bump, Android stops and offers to reset the device with a generic provisioning error such as:
Couldn't set up your device. For help, contact your IT admin.- Setup sits on download or update screens for a long time, then fails.
- The Microsoft sign-in page opens in a Chrome tab but access is blocked, and the Microsoft Entra sign-in log shows
AADSTS53000 (DeviceNotCompliant). - Registration in the Microsoft Intune app ends with
Something went wrongor never completes (reported by admins). - The device enrolls, but in the wrong mode (fully managed instead of COPE) or outside the expected group.
Android's error wording varies by version and manufacturer, so match on where in setup the failure happens, not only on the text.
Why it happens#
Corporate enrollment is a chain, and each link has its own failure pattern:
| Link | What must be true | Typical break |
|---|---|---|
| Device | New or factory reset; for fully managed, Android 10 or later with Google Mobile Services available | Used device not reset, hardware without Google Mobile Services, old OS |
| Token | A valid token from the right enrollment profile | Token revoked or replaced, profile deleted, staging token expired, old printed QR codes |
| Provisioning method | QR code, token entry, NFC, zero-touch or Knox Mobile Enrollment delivering that token | QR code from another profile type, zero-touch or Knox configuration still holding an old token, afw#setup or NFC used for COPE on Android 11 or later |
| Downloads | Android Device Policy and the Microsoft apps install from Google Play | Captive portal, authenticated proxy, TLS inspection, blocked Google endpoints |
| Sign-in | The user signs in to Microsoft Entra ID in a Chrome tab | Conditional Access requires a compliant device before the device can be compliant |
| Registration | Microsoft Authenticator (installed automatically, required) and the Microsoft Intune app finish registration | App downloads failing, temporary service problems |
How to fix it#
1. Start from a clean, supported device#
Corporate modes can only be set up from the first setup screen, so factory reset any device that has been used. For fully managed enrollment, Microsoft requires Android 10 or later and a build with Google Mobile Services connectivity. Check that the device is Play Protect certified; Google documents how to check this in the Play Store settings. Devices without Google Mobile Services belong in AOSP enrollment, not here.
2. Check the profile and its token#
In the Intune admin center go to Devices › Enrollment, select the Android tab and, under Android Enterprise › Enrollment Profiles, open Corporate-owned, fully managed user devices or Corporate-owned devices with work profile. Then:
- Open the profile and select Token to view, replace, revoke or export it. A revoked token stops working immediately; after replacing one, use the new QR code everywhere. None of these actions affects devices that are already enrolled. In the COPE list, a profile whose token was revoked only shows when you filter for Inactive as well as Active.
- Check the token type. Fully managed profiles use Corporate-owned, fully managed (default) or Corporate-owned, fully managed, via staging, and COPE profiles the matching Corporate-owned with work profile pair. In both, only the staging token has an expiration date (up to 65 years ahead), and enrollment time grouping doesn't work with it.
- If zero-touch or Knox Mobile Enrollment uses the profile, export the token JSON again after any replacement and update those configurations.
- Avoid renaming a profile that's in use: dynamic groups built on
enrollmentProfileNamematch on the exact name, and Microsoft notes they can't be used with the default fully managed profile.
3. Use the provisioning method correctly#
- QR code: on the welcome screen of a reset device, tap the same spot six times, connect to Wi-Fi when prompted and scan the code from the profile's Token page.
- Token entry: continue setup to the Google account sign-in screen and type
afw#setup. Android downloads Android Device Policy, then asks you to scan the QR code or enter the token. - COPE on Android 11 and later: Microsoft supports
afw#setupand NFC for corporate-owned work profile devices only on Android 8 to 10, so use the QR code, zero-touch or Knox Mobile Enrollment instead. - NFC, zero-touch and Knox Mobile Enrollment deliver the same token; see Android zero-touch enrollment with Intune and Knox Mobile Enrollment with Intune.
A device in the wrong mode almost always got a token from the wrong profile; reset it and enroll again.
4. Give setup a clean network#
Before the Microsoft sign-in appears, the device downloads Android Device Policy and other apps from Google Play and may update Google components. Use Wi-Fi without a captive portal, authenticated proxy or TLS inspection, and allow the hosts Google lists for Android Enterprise as well as Microsoft's Intune and Microsoft Entra endpoints. Let setup finish without restarting the device.
5. Unblock the Microsoft Entra sign-in#
Android setup authenticates the user in a Chrome tab. If a Conditional Access policy requires a compliant device and applies to all cloud apps on Android and browsers, exclude the Microsoft Intune cloud app from it, as Microsoft's setup guide instructs; a device can't be compliant before it has enrolled. In the Microsoft Entra sign-in log, filter by the user and look for failures such as AADSTS53000; AADSTS53000 and AADSTS53003 explained shows how to find the policy responsible.
6. If registration fails or hangs#
- Microsoft Authenticator installs automatically on fully managed and COPE devices (COPE also gets the Microsoft Intune app) and can't be removed; if Google Play can't deliver it, registration can't complete.
- Confirm the user has an Intune licence and can sign in normally on another device.
- Check Health › Service health in the Microsoft 365 admin center for Intune advisories. Admins have reported registration failures that cleared once a service issue was resolved, so retry before resetting again.
Verify the fix#
- The device appears in the Intune device list with corporate ownership and the enrollment type you intended (fully managed or corporate-owned work profile), named by the profile's naming template if you set one.
- If you use a dynamic group on
enrollmentProfileNameor enrollment time grouping, the device is in the group and policies and apps start to arrive. - The user is signed in to the Microsoft Intune app, and the device reports a compliance state rather than staying in "not evaluated".
- The Microsoft Entra sign-in log shows a successful sign-in for the enrollment.
Prevent it next time#
- Label printed QR codes with the profile name and token type, and revoke tokens when an enrollment project ends or a code leaks.
- Keep one test device per model, re-test after Android updates, and plan around Microsoft's minimum versions (Android 10 for fully managed).
- Document the Microsoft Intune exclusion in your Conditional Access policies so it isn't removed during a clean-up.
- When a vendor prepares devices, use the staging token so users only sign in to the Microsoft Intune app.
Related guides: personally owned work profile enrollment failures, dedicated devices with Managed Home Screen and the Android enrollment errors quick reference.
References#
- Set up enrollment for Android Enterprise fully managed devices (Microsoft Learn)
- Set up Intune enrollment of Android Enterprise corporate-owned devices with work profile (Microsoft Learn)
- Troubleshooting Android Enterprise device enrollment in Intune (Microsoft Learn)
