Intune reports a failed profile or compliance check as a hex code, a negative decimal, a bare 65000, a status word or a sentence. This quick reference decodes the profile, SyncML, iOS/iPadOS, compliance and BitLocker results admins meet most: Microsoft's description, the usual cause and the first check, with links to this site's detailed guides.
Codes in this quick reference
65000: per-setting form of 0x87D1FDE8 Remediation failed (0xFDE8 = 65000)Intune admin center (per-setting status)0x87D1FDE8 (-2016281112) Remediation failedIntune admin center (profile status)0x87D1FDE9 (-2016281111) Not applicable for this deviceIntune admin center (profile status)0x87D1FDEA (-2016281110) Invalid parameter to CIM settingIntune admin center (profile status)0x87D1FDEB (-2016281109) Data type conversion failedIntune admin center (custom profile)0x87D1FDEE (-2016281106) Not applicable because it lost in conflict resolutionIntune admin center (profile status)0x87D1FDEF (-2016281105) Failed to evaluate the RuleIntune admin center (profile status)0x87D1FDF0 (-2016281104) MDM CI certificate info not foundIntune admin center (certificate profile)
+ 42 more codes in the tables below.
How to read these codes#
Profile results appear on each profile under Devices › Manage devices › Configuration (Device status and Per setting status) and on a device's Device configuration page. Compliance results appear under Devices › Compliance (the Monitor tab, and each policy's Per-setting status), and BitLocker details in the encryption report: Devices › Manage devices › Configuration › Monitor › Device encryption status. The format tells you which layer raised it:
0x87D1FD…: Intune configuration item (CI) results such as Remediation failed.65000is0xFDE8, the last four hex digits of0x87D1FDE8.0x87D101…and other OMA response codes: results returned by a Windows configuration service provider (CSP). For SyncML codes, the low part is the SyncML status:0x194is 404,0x1F4is 500.- Codes with a device number such as
29000:: iOS/iPadOS payload errors (enrollment errors are in the Apple quick reference). - Words such as In grace period or Not evaluated: compliance states, which have no code.
- Sentences under Status details in the encryption report: BitLocker state from the BitLocker CSP.
Microsoft lists every code as a signed decimal and in hex, and Intune shows either. Read 2016281112 without the minus sign as -2016281112. PowerShell converts both ways:
PowerShell
'0x{0:X8}' -f -2016281112 # 0x87D1FDE8
[int]0x87D1FDE8 # -2016281112
0x87D1FDE8 -band 0xFFFF # 65000Windows: configuration item results (0x87D1FDxx)#
Judging by their messages, the last four concern certificate delivery (SCEP/NDES or PKCS), but Microsoft documents only the text, not the causes. On the device, failures appear as event 404 in the DeviceManagement-Enterprise-Diagnostics-Provider Admin log, with the failing CSP node.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
65000 | Same failure as 0x87D1FDE8 (Remediation failed), shown per setting | The device received the setting but couldn't apply it | Find the setting in Per setting status, then event 404 (65000 guide) |
0x87D1FDE8 (-2016281112) | Remediation failed | Unsupported edition or build, no step-up to Enterprise, a missing dependency, or a competing GPO | Edition and build against the CSP's applicability |
0x87D1FDE9 (-2016281111) | Not applicable for this device | Platform, edition or OS version outside the setting's scope | Assignment filters on edition or OS version |
0x87D1FDEA (-2016281110) | Invalid parameter to CIM setting | Value outside the allowed range or format | The allowed values in the CSP documentation |
0x87D1FDEB (-2016281109) | Data type conversion failed | Custom OMA-URI data type doesn't match the CSP | The CSP's format; ADMX-backed policies take String |
0x87D1FDEE (-2016281106) | Not applicable because it lost in conflict resolution | Another policy sets the same setting | Every policy that sets it (policy conflicts guide) |
0x87D1FDEF (-2016281105) | Failed to evaluate the Rule | The device couldn't evaluate the setting, so there's no result | Sync again; if it repeats, event 404 for that node |
0x87D1FDF0 (-2016281104) | MDM CI certificate info not found | No cause documented: Intune didn't find the certificate information this profile relies on | Trusted certificate profiles assigned to the same groups (SCEP/PKCS guide) |
0x87D1FDF1 (-2016281103) | MDM CRP certificate info not found | No cause documented: certificate information for the certificate request (CRP) wasn't found | Status of the certificate profile and its trusted root profile |
0x87D1FDF2 (-2016281102) | NDES URL not found | No cause documented beyond the message: no SCEP server (NDES) URL was found for the profile | SCEP Server URLs in the profile |
0x87D1FDF3 (-2016281101) | MDM CRP request not found | No cause documented: the certificate request (CRP) wasn't found | Tenant administration › Connectors and tokens › Certificate connectors; connector logs |
Windows: OMA-DM (SyncML) response codes#
These come from the CSP itself; event 404 names the node.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D10194 (-2016345708) | Syncml (404): The requested target was not found. | Wrong OMA-URI path, a node missing on this build, or an ADMX that was never ingested | The CSP URI in event 404 (custom ADMX guide) |
0x87D10195 (-2016345707) | Syncml (405): The requested command is not allowed on the target. | The node doesn't accept that operation, for example a read-only node | Supported operations for the node in the CSP documentation |
0x87D10196 (-2016345706) | Syncml (406): The requested command failed because an optional feature in the request was not supported. | Feature not available on this edition or build | Edition and build |
0x87D101A9 (-2016345687) | Syncml (425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | The node's access control list doesn't allow this command from the MDM server; Microsoft lists no specific triggers | The node's scope (./Device or ./User) and supported operations in the CSP documentation |
0x87D101F4 (-2016345612) | Syncml (500): The recipient encountered an unexpected condition which prevented it from fulfilling the request | The CSP failed while applying the value | The Result text in event 404 |
0x87D10837 (-2016344009) | (1403): Certificate not found | A certificate the setting refers to isn't on the device | The certificate profiles a Wi-Fi or VPN profile depends on |
iOS/iPadOS: profile and payload errors#
The number before the colon is the device's own error code.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x87D11388 (-2016341112) | iOS device is currently busy | The device couldn't process the command at that moment; Microsoft's app install reference names a locked device | Have the user unlock the device, then sync |
0x87D19858 (-2016307112) | 29000: Device not supervised | A supervised-only setting reached an unsupervised device | Supervision on the device record (iOS profiles guide) |
0x87D136B0 (-2016332112) | 4000: Cannot parse profile | Malformed payload, for example in a custom profile | Validate the custom profile's XML |
0x87D136B4 (-2016332108) | 4004: User canceled installation | Someone canceled the installation on the device; Microsoft gives no further detail | Ask the user what they canceled, then sync again |
0x87D136B5 (-2016332107) | 4005: Passcode does not comply | The device passcode doesn't meet the profile's requirements | The user updates the passcode; review the passcode policy |
0x87D1791D (-2016315107) | 21005: Account not unique (Email Profile already exists on device) | An email profile for the same account already exists on the device (for example, added manually) | Remove the manual account, then sync |
0x87D17D05 (-2016314107) | 22005: Network error | The device couldn't reach the SCEP server during certificate enrollment | The SCEP URL from the device's network (SCEP/PKCS guide) |
0x87D161A8 (-2016321112) | 15000: Cannot install VPN | The VPN payload was rejected | Connection type and VPN app (VPN profiles guide) |
Compliance states and the built-in checks#
A policy's report covers only that policy; the overall state counts every policy plus the Default Device Compliance Policy. Compliance settings beat configuration settings, and between compliance policies the most secure wins.
| Result | Meaning | Usual cause | First check |
|---|---|---|---|
| In grace period | Targeted and not yet compliant, but inside the grace period the admin set | The user hasn't fixed a setting yet, such as password complexity | Per-setting status; the policy's actions for noncompliance |
| Not evaluated | Initial state for newly enrolled devices | No policy and no trigger, no check-in since the policy changed, or no user (ADE without user affinity, Android Enterprise dedicated, DEM-enrolled) | Assign a policy to a device group; sync |
| Pending | The device hasn't checked in to receive or report compliance status | Device offline or not synced yet | Last check-in (check-in guide) |
| Not compliant | The device failed one or more settings, or the user didn't comply | A setting in any assigned policy | The device's Device compliance page, then the failing setting |
| Error (setting) | The device keeps its existing state for up to seven days, then becomes Not compliant (or In grace period if one is set) | The setting couldn't be evaluated correctly | Sync, then look at the failing setting |
| Has a compliance policy assigned | Fails if no applicable compliance policy reaches the device | Only user-targeted policies on a userless device, with Mark devices with no compliance policy assigned as set to Not compliant | Assignments (default policy guide) |
| Is active | Fails when the device stops contacting Intune (30 days by default) | Device off or offline; stale record after a reset | Last check-in; retire stale records |
| Enrolled user exists | Fails when the device's user is gone or has no Intune licence | Deleted account or removed licence | User and licence in Microsoft Entra ID |
Windows compliance settings that fail most#
BitLocker, Secure Boot and code integrity use health attestation, measured at boot; for Windows 11, Microsoft has announced a move to Microsoft Azure Attestation (health attestation guide).
| Setting result | Meaning | Usual cause | First check |
|---|---|---|---|
| Require BitLocker: Not compliant | Health attestation reported BitLocker off at the last boot | Encryption finished but the device hasn't restarted | Restart, sync, manage-bde -status C: |
| Require Secure Boot to be enabled on the device: Not compliant | The device didn't boot with Secure Boot | Secure Boot off; devices without TPM 2.0 support show Not Compliant | Confirm-SecureBootUEFI, Get-Tpm |
| Require code integrity: Not compliant | Health attestation reported a code integrity failure | An unsigned driver or changed system file loaded into the kernel | Recently installed drivers |
| Encryption of data storage on a device: Not compliant | No encryption found on the OS drive (BitLocker only) | OS drive not yet encrypted with BitLocker | Silent encryption guide |
| Firewall: Error or Not compliant | Error can follow a sync straight after restart or wake; Not compliant if a GPO turns it off or allows all inbound | Timing, or Group Policy overriding Intune | Sync manually; remove the conflicting GPO |
| Trusted Platform Module (TPM): Not compliant | No TPM version reported | TPM missing or disabled in firmware | Get-Tpm |
| Antivirus / Antispyware: Not compliant | The product registered with Windows Security Center is disabled or out of date | Antivirus turned off or stale definitions | Windows Security (Defender guide) |
| Require the device to be at or under the machine risk score: Not compliant | Defender for Endpoint risk above the allowed level | Active alerts on the device | Machine risk score guide |
BitLocker: encryption report status details#
Intune shows these for Windows 10 (April 2019 Update or later) and Windows 11; one device can report several.
| Status detail | Meaning | Usual cause | First check |
|---|---|---|---|
| The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent. | Encryption waits for the user | Policy isn't set up for silent encryption | Silent encryption settings |
| The encryption method of the OS volume doesn't match the BitLocker policy. | Drive encrypted with another method | Usually encrypted before the policy arrived | manage-bde -status C:; re-encryption plan |
| The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used. | Protector differs from policy; TPM-only and startup key variants exist | Startup authentication changed after encryption, or no PIN set | manage-bde -protectors -get C: |
| The OS volume is unprotected. | Encryption suspended or incomplete | Protection suspended or interrupted | manage-bde -status C: |
| Recovery key backup failed. | The key wasn't escrowed | Escrow didn't complete; if the report also shows "The network isn't available, which is required for recovery key backup.", start with connectivity | BitLocker-API events (key escrow guide) |
| To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Microsoft Entra ID, the AllowStandardUserEncryption policy must be set to 1. | A standard user can't start encryption | Standard user encryption not allowed | The standard-user encryption setting |
| Windows Recovery Environment (WinRE) isn't configured. | WinRE not detected | WinRE disabled or missing | reagentc /info |
| A TPM isn't available for BitLocker, either because it isn't present, it's been made unavailable in the Registry, or the OS is on a removable drive. | Policy needs a TPM it can't use | TPM disabled in firmware | Get-Tpm; firmware |
| The TPM isn't ready for BitLocker. | TPM present but not initialised | TPM needs initialising | Get-Tpm (TpmReady), Initialize-Tpm |
How to verify a fix#
- Profiles: sync from Settings › Accounts › Access work or school (account › Info › Sync). No new event 404 for that node, then Per setting status shows Succeeded; reporting lags the device.
- Compliance: checking status in Company Portal triggers an evaluation; a policy's Device status chart can take up to 24 hours.
- Health attestation and BitLocker: restart after encryption or Secure Boot changes; the encryption report can take up to 24 hours. For Android, see the Android quick reference.
PowerShell
Get-WinEvent -FilterHashtable @{
LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
Id = 404
} -MaxEvents 20 -ErrorAction SilentlyContinue | Format-List TimeCreated, Message
manage-bde -status C:
Get-Tpm | Select-Object TpmPresent, TpmReady
Confirm-SecureBootUEFIReferences#
- Error and status codes in Microsoft Intune (Microsoft Learn): the code list
- Monitor results of your Intune device compliance policies (Microsoft Learn)
- Windows compliance settings in Microsoft Intune (Microsoft Learn)
- Monitor device encryption with Intune (Microsoft Learn)
