Android errors in Intune rarely come with a code: users see a sentence in Company Portal or Android setup, and admins see a blocked sign-in or a setting marked Not compliant. This quick reference lists the Android Enterprise enrollment, management and compliance results Microsoft documents, with what each means, the usual cause and the first check, and links to this site's detailed Android guides.
Codes in this quick reference
DeviceCapReachedCompany Portal (enrollment)Company Portal Temporarily UnavailableCompany Portal (enrollment)MDM authority not definedCompany Portal (enrollment)Looks like your IT admin hasn't set an MDM authority. Get help from your IT admin or try again later.Company PortalYour IT admin hasn't given you access to use this app. Get help from your IT admin or try again later.Company PortalProfile installation failedAndroid device (enrollment)Symptom: can't create policy or enroll devices (special characters in the company name)Intune admin center / enrollmentSymptom: enrollment fails because Google Play services is out of dateAndroid device (enrollment)
+ 32 more codes in the tables below.
Note: Microsoft documents Android device administrator (DA) management as deprecated and no longer available for devices with access to Google Mobile Services. This reference covers Android Enterprise: personally owned work profile, fully managed, dedicated and corporate-owned work profile (COPE). App install codes for DA and Samsung Knox devices are in the app install quick reference.
How to read these errors#
Note the exact text and where it appeared:
- On the device: Android setup (QR code, token or NFC provisioning), the Company Portal app during work profile enrollment, or the Microsoft Intune app on corporate-owned devices.
- Microsoft Entra sign-in log: Android enrollment signs the user in through a Chrome tab, so Conditional Access blocks appear as AADSTS codes (AADSTS quick reference).
- Intune admin center: enrollment profiles and tokens under Devices › Device onboarding › Enrollment (Android tab), and compliance under Devices › Compliance or the device's Device compliance page.
In the tables, exact on-screen texts are in code format or quotation marks. Rows in plain text describe a symptom or a documented behaviour that has no message of its own.
First, run Microsoft's self-help diagnostic: in the Microsoft 365 admin center go to Show all › Support › Help & support, describe the problem, and run the Intune Android enrollment test with the user's address. It can't change your tenant, but it flags known configuration problems. Users can send logs too; Microsoft's user help article "Send Android enrollment errors to your IT admin" shows them how.
Enrollment errors on any Android device#
| Error or symptom | Meaning | Usual cause | First check |
|---|---|---|---|
DeviceCapReached | The user is enrolling more devices than the device limit allows | Old device records still count against the user | The user's devices (Users › All users › user › Devices) against the device limit restriction; remove stale records (work profile guide) |
Company Portal Temporarily Unavailable | Company Portal couldn't complete enrollment | Company Portal out of date or corrupted; the device limit can also cause it | Reinstall Company Portal from Google Play; test sign-in at https://portal.manage.microsoft.com, and from another network if that fails |
MDM authority not defined | No MDM authority found for the user | MDM authority not set, or a problem syncing the user's credentials | That the MDM authority is Intune; that the UPN matches between Active Directory and Microsoft Entra ID |
| "Looks like your IT admin hasn't set an MDM authority. Get help from your IT admin or try again later." | The same problem, as Company Portal words it | The MDM authority hasn't been defined | Set the MDM authority |
| "Your IT admin hasn't given you access to use this app. Get help from your IT admin or try again later." | The user isn't licensed to enroll | No licence, or the wrong licence type | Troubleshooting + support › Troubleshoot: select the user, check the Intune licence |
Profile installation failed | The management profile couldn't be installed | Missing licence, another MDM or management profile already present, or browser settings | Licence; remove the other MDM; Chrome as default browser with cookies enabled |
| Unable to create policy or enroll devices | Policy creation and enrollment fail tenant-wide | Special characters in the company name | Remove them from the company name in the Microsoft 365 admin center |
| Unable to enroll with outdated Google Play services | An old Google Play services version can stop enrollment | Device not updated | Open Google Play services on the device and update it |
| Company Portal earlier than 5.0.5421.0 | Unsupported since 1 October 2025: devices may lose registration status and be marked noncompliant | Company Portal not updated | Update Company Portal from Google Play |
Personally owned work profile#
Personally owned work profiles can also use web-based enrollment (managed through the Android Management API), where users enroll in a browser rather than in Company Portal; most device-side checks below apply to both. User-side requirements are in Microsoft's user help article Enroll device and create Android work profile (work profile guide).
| Error or symptom | Meaning | Usual cause | First check |
|---|---|---|---|
| Can't create a work profile | Android couldn't create the work profile although the device meets the requirements | An existing work profile, or manufacturer restrictions | Settings › Passwords & accounts › Work (location varies by manufacturer); try Google's Test DPC app |
| Encryption is required when a device is enrolled | Expected: Google requires encryption to create a work profile | By design; it can't be turned off | Nothing to fix; let encryption finish |
| Work profile enrollment from a secondary user account | Not supported: Microsoft's user help says to enroll from the device's primary user account | The user is signed in to a secondary Android user | Switch to the primary user and enroll there |
| Work profile can't be set up outside Android Enterprise regions | Company Portal can't create a work profile where Android Enterprise isn't available | Device used in an unsupported country or region | Google's list of supported countries and regions; another access method for those users |
Corporate-owned: fully managed, dedicated and COPE#
Fully managed enrollment needs Android 10 or later with Google Mobile Services, and every corporate mode uses a token from Devices › Device onboarding › Enrollment (Android tab, Enrollment Profiles), delivered by methods such as QR code, token entry, NFC, zero-touch or Knox Mobile Enrollment (fully managed and COPE guide).
| Error or symptom | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS53000 (DeviceNotCompliant) during setup | Conditional Access wants a compliant device before the device has enrolled | A compliant-device policy covers all cloud apps on Android and browsers; setup signs in through a Chrome tab | Exclude the Microsoft Intune cloud app from that policy (AADSTS53000 guide) |
| Enrollment token no longer works | A revoked token is unusable; a staging token stops at its expiration date | Token revoked or replaced, or staging token expired | The profile's Token page; redistribute the new QR code |
| Enrollments fail after a profile was renamed | Microsoft warns that renaming an assigned profile can prevent future enrollments | Profile renamed after assignment | Create and assign a new profile, then delete the old one; dynamic group rules match the name too |
| Device not placed in the enrollment-time group | Enrollment time grouping isn't supported with the staging token | Profile uses Corporate-owned, fully managed, via staging | Use the default token for grouping, or a dynamic group |
| Dynamic group stays empty | Dynamic groups can't be used with the default enrollment profile | Devices enrolled with Default Fully Managed Profile | A named profile and (device.enrollmentProfileName -eq "Profile name"); assignment filters if only Intune targeting is needed |
| Zero-touch or Knox Mobile Enrollment uses an old token | Their configurations hold token JSON exported from Intune | Token replaced or revoked in Intune only | Export token again and update the configuration (zero-touch guide, Knox guide) |
| Dedicated device users can't sign in to protected resources | Expected without Microsoft Entra shared device mode, even when the device is compliant | Dedicated token without shared device mode | Shared device mode for sign-in scenarios (dedicated devices guide) |
| Not evaluated on dedicated devices | Dedicated devices aren't associated with a user | Compliance policy assigned to user groups | Assign dedicated-device compliance policies to device groups |
Management, remote actions and Managed Google Play#
| Error or symptom | Meaning | Usual cause | First check |
|---|---|---|---|
| Managed Google Play Last Sync time hasn't been updated in days | Expected: this sync is manual | Nobody triggered it | Select Sync on the Managed Google Play page when you need changes in Intune |
| Wipe (Factory Reset) option isn't available | Expected on personally owned work profile devices | Intune doesn't control the whole device | Use Retire, which removes the work profile and its data; Wipe works on COPE (device actions guide) |
| Device passcode reset not supported | Work profile devices allow only a work profile passcode reset | Personally owned: needs Android 8.0 or later, a managed work profile passcode and the user's permission | Reset the work profile passcode; fully managed and dedicated devices support device passcode reset |
| Microsoft Authenticator can't be uninstalled | Expected on fully managed devices: it installs during enrollment and is required | By design | Nothing to fix |
Compliance results on Android Enterprise#
These show as Not compliant against the setting on the device's Device compliance page.
| Setting result | Meaning | Usual cause | First check |
|---|---|---|---|
| Rooted devices: Not compliant | Block marks rooted devices as noncompliant | The device is rooted | Confirm with the user; it stays noncompliant while rooted |
| Play Integrity Verdict (Check basic integrity): Not compliant | The device failed Play's basic integrity check | Usually a rooted, emulated or otherwise tampered system (Google's integrity verdict documentation explains the labels) | Device model and OS build |
| Play Integrity Verdict (Check basic integrity & device integrity): Not compliant | The device failed the basic or the device integrity check | Not Play Protect certified, or a modified system | Play Protect certification status in Play Store settings |
| Check strong integrity: Not compliant | Failed Play's hardware-backed check; devices that don't support it are marked noncompliant | Hardware without that support | Require it only for models that support it |
| Google Play Protect settings fail without Google Mobile Services | Devices in regions without Google Mobile Services fail these settings | Device operating where Google Mobile Services isn't available | A separate policy for those devices |
| Google Play Services is configured: Not compliant | The Google Play services app isn't installed and enabled | App disabled or removed | Enable or update it; doesn't apply to web-enrolled work profiles |
| Up-to-date security provider: Not compliant | No up-to-date security provider protects the device | Outdated Google components | Update Google Play services; doesn't apply to web-enrolled work profiles |
| Require the device to be at or under the Device Threat Level: Not compliant | The mobile threat defense service reports a threat above the allowed level | Active threat, or the MTD app isn't reporting | Partner console and connector status (MTD guide) |
| Require the device to be at or under the machine risk score: Not compliant | Defender for Endpoint reports risk above the allowed level | Active alerts; support varies by enrollment type | Machine risk score guide |
| Minimum OS version: Not compliant | OS older than the minimum; users get a link on how to upgrade | Device not updated | Update the device |
| Maximum OS version: access blocked | OS later than the rule allows; the user is asked to contact IT | A new release not yet approved | Change the rule to allow the version |
| Minimum security patch level: Not compliant | Patch level older than the date (YYYY-MM-DD) | The OEM or carrier hasn't shipped the patch | Patch availability for the model before raising the date |
| Password complexity (Android 12 and later): users must update the device password | If the device password is too weak, users must update it, then the work profile password | Required password type changed from Device default: newly enrolled Android 12 and later devices get High complexity | Configure Password complexity instead of the deprecated settings |
| Company Portal app runtime integrity or Intune app runtime integrity: Not compliant | Company Portal (personally owned): not properly signed, no default runtime, in debug mode or from an unknown source. Intune app (corporate-owned): runtime or signing check failed | Sideloaded or modified app | Reinstall it from Google Play |
| Block USB debugging on device: Not compliant | USB debugging is on | Developer options on a personally owned device | Turn it off; corporate-owned modes already disable it |
How to verify a fix#
- Enrollment: the device appears in Intune with the expected ownership and enrollment type, and under the user's Devices. Rerun the Microsoft 365 admin center diagnostic to confirm the issue is cleared.
- Sign-in: the Microsoft Entra sign-in log shows a successful enrollment sign-in with no Conditional Access failure.
- Groups: the device joins the expected group, and apps and policies arrive.
- Compliance: have the user check status in the Company Portal app or website, which triggers an evaluation; reports update when the device checks in.
To review many devices at once, Microsoft Graph PowerShell lists enrollment type and compliance state (more in the Graph reporting guide):
PowerShell
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All'
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Android'" -All |
Select-Object DeviceName, UserPrincipalName, ManagedDeviceOwnerType,
DeviceEnrollmentType, ComplianceState, LastSyncDateTime |
Sort-Object LastSyncDateTimeReferences#
- Troubleshooting Android Enterprise device enrollment in Intune (Microsoft Learn)
- Troubleshoot device enrollment in Intune (Microsoft Learn): device cap, MDM authority, licence and profile installation errors, and the self-help diagnostics
- Set up enrollment for Android Enterprise fully managed devices (Microsoft Learn): tokens, staging, dynamic groups and the Conditional Access exclusion
- Device compliance settings for Android Enterprise in Intune (Microsoft Learn)
