Credentials Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)Microsoft Certified: Azure Solutions Architect Expert (AZ-305)PMI Project Management Professional (PMP) 28 certifications · see all Verify on Credly
Omer EltayebMicrosoft 365
LinkedIn
Intune error library

Intune, Autopilot and Jamf errors — and how to fix them

Search 602 error codes and messages from 112 guides for Microsoft Intune, Windows Autopilot, Apple and Android management, Jamf and third-party integrations. Paste the code or message you see — 0x80180014, 0x87D1041C (or its decimal form -2016345060), 65000, an AADSTS code, a Company Portal or Jamf message — and open the guide that fixes it.

Exchange Server error library (701) Configuration Manager error library (70) Microsoft 365 error library (169) Jamf + Intune hub (16 guides) Download all as CSVJSON

Area
Code lists

Showing all 602 errors

Enrollment

Windows enrollment, Company Portal, device check-in and enrollment restrictions

17
0x8018002bDeviceManagement-Enterprise-Diagnostics-ProviderWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180003Access work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180013Access work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180018Access work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where 2149056522Task Scheduler operational logIntune device not checking in: diagnosing a Windows device that stopped syncing Auto MDM Enroll: FailedDeviceManagement-Enterprise-Diagnostics-ProviderWindows enrollment error 0x80180018 and its neighbours: what to check, and where Company Portal Temporarily UnavailableCompany PortalCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else DeviceCapReachedCompany PortalCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else Event ID 7016 (Task Scheduler)Task Scheduler operational logIntune device not checking in: diagnosing a Windows device that stopped syncing It looks like you're not connected.Access work or schoolCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else Looks like the MDM Terms of Use endpoint is not correctly configuredAccess work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where The sync could not be initiated (0x80072f9a)Access work or schoolIntune device not checking in: diagnosing a Windows device that stopped syncing There was an error with your licenseAccess work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where This device is already assigned to someone in your organization. Contact company support about becoming the primary device user.Company Portal (Windows)Company Portal for Windows: Sync fails, device not enrolled or assigned to someone else This user isn't authorized to enrollAccess work or school / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where We couldn't auto-discover a management endpoint matching the username entered.Access work or schoolCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else Your device is already being managed by an organizationAccess work or schoolCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else

Autopilot

Autopilot profiles, the Enrollment Status Page, hybrid join, pre-provisioning and device preparation

26
0x87D1041CAppWorkload.logEnrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide 0x800706FDDeviceManagement-Enterprise-Diagnostics-ProviderPre-provisioning hybrid join fails when a policy needs a domain controller (0x800706FD) 0x800706FDDeviceManagement-Enterprise-Diagnostics-ProviderWindows Autopilot known issues in 2026: what's open, what's fixed and how to stay informed 0x80004005Autopilot / OOBE (Enrollment Status Page)Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix 0x80004005Autopilot / OOBE (Enrollment Status Page)Windows Autopilot known issues in 2026: what's open, what's fixed and how to stay informed 0x80180014Autopilot / OOBE (Enrollment Status Page)Windows Autopilot error 0x80180014 when redeploying a device: cause and fix Another installation is in progress, please try again laterAppWorkload.logEnrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide Cannot start service ODJConnectorSvcIntune Connector for AD (configuration)Intune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA DeviceNotSupportedMDM enrollment ETW traceWindows Autopilot error 0x80180014 when redeploying a device: cause and fix Enrollment blocked for AP device by SDM One Time Limit CheckMDM enrollment ETW traceWindows Autopilot error 0x80180014 when redeploying a device: cause and fix ERROR_NOT_SUPPORTED (0x80070032)Autopilot ResetWindows Autopilot known issues in 2026: what's open, what's fixed and how to stay informed Event ID 2800 (DeviceManagement-Enterprise-Diagnostics-Provider)Event ViewerEnrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide Export of device link information timed outAutopilot / OOBE (Export device information)Windows Autopilot device preparation: known issues and how to troubleshoot a failed run Failed to update security group device preparation settingIntune admin center (Device preparation policy)Windows Autopilot device preparation: known issues and how to troubleshoot a failed run InvalidZtdHardwareHashIntune admin center (Autopilot device import)Windows Autopilot from scratch: register devices, build a user-driven profile and assign it MDM PolicyManager: Merge string, Area: (UserRights), Policy: (DenyLocalLogOn), Result:(0x800706FD)DeviceManagement-Enterprise-Diagnostics-ProviderPre-provisioning hybrid join fails when a policy needs a domain controller (0x800706FD) MSA not validIntune Connector for AD (configuration)Windows Autopilot known issues in 2026: what's open, what's fixed and how to stay informed SeLogonAsServicePrivilegeMissingIntune Connector for AD (configuration)Intune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA System.Security.Principal.WindowsIdentity.KerbS4ULogon(String upn, SafeAccessTokenHandle& safeTokenHandle)Intune Connector for AD (UI / setup logs)Intune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA The service did not start due to a logon failureIntune Connector for AD (configuration)Intune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA The trust relationship between this workstation and the primary domain failed.DeviceManagement-Enterprise-Diagnostics-ProviderPre-provisioning hybrid join fails when a policy needs a domain controller (0x800706FD) There was a problem with the device security groupIntune admin center (Device preparation policy)Windows Autopilot device preparation: known issues and how to troubleshoot a failed run Your organization does not support this version of Windows. (0x80180014)Access work or school (Entra join)Windows Autopilot error 0x80180014 when redeploying a device: cause and fix ZtdDeviceAlreadyAssignedIntune admin center (Autopilot device import)Windows Autopilot from scratch: register devices, build a user-driven profile and assign it ZtdDeviceAssignedToAnotherTenantIntune admin center (Autopilot device import)Windows Autopilot from scratch: register devices, build a user-driven profile and assign it ZtdDeviceDuplicatedIntune admin center (Autopilot device import)Windows Autopilot from scratch: register devices, build a user-driven profile and assign it

Apps & scripts

Win32 apps and the IME, Store apps, app protection, PowerShell scripts and remediations

21
0x8A15001B The Microsoft Store client is blocked by policyWinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A15001C The Microsoft Store app is blocked by policyWinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A15003A Operation is blocked by Group PolicyWinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A15005E The server certificate did not match any of the expected values.WinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A150008 Downloading installer failedWinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A150101 Application is currently running. Exit the application then try again.WinGet / Intune install statusMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x87D1041CIntune admin center (Device install status)Win32 app error 0x87D1041C: the app installed but Intune can't detect it 0x87D1041CIntune admin center (Device install status)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules 0x87D1041CIntune admin center (Device install status)Win32 app supersedence and dependencies in Intune: upgrade chains that don't break 1603 Fatal error during installation.Installer exit code (AppWorkload.log)Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization 1618AppWorkload.log (installer return code)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules 1618 Another installation is already in progress.Installer exit code (AppWorkload.log)Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization 1641AppWorkload.log (installer return code)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules 3010AppWorkload.log (installer return code)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules Failed to retrieve content information. (0x87D30065)Intune admin center (app install status)Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization Outlook pasted from your clipboardDevice (Android 12+ toast notification)Current Intune known issues that aren't your fault: Company Portal, Store apps, compliance messages Report-only: FailureMicrosoft Entra sign-in logApp protection policies not applying to Outlook mobile: a troubleshooting checklist Requirements Not MetCompany PortalMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes The application was not detected after installation completed successfully (0x87D1041C)Intune admin center (Device install status)Win32 app error 0x87D1041C: the app installed but Intune can't detect it The application was not detected after installation completed successfully (0x87D1041C)Intune admin center (app install status)Microsoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes To access your service, app, or website, you might need to sign in to Microsoft Edge using username@domain.comMicrosoft Edge (sign-in prompt)Intune app protection for Windows (MAM in Edge): setup, Conditional Access and errors

Policies & compliance

Configuration profiles, settings catalog, compliance, certificates, VPN and Conditional Access

40
0x87D1FDE8 Remediation failedIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D1FDE9 Not applicable for this deviceIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D1FDEB Data type conversion failedIntune admin center (custom profile)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D101F4 Syncml (500): The recipient encountered an unexpected condition which prevented it from fulfilling the requestIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D10196 Syncml (406): The requested command failed because an optional feature in the request was not supported.Intune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x800705B4Autopilot / OOBE (self-deploying mode)Windows kiosk and Shared PC with Intune: single-app, multi-app and shared devices 65000Intune admin center (per-setting status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 65007 Script returned failureIntune device compliance reportsCustom compliance in Intune: writing the discovery script and JSON rules 65008 Setting missing in the script resultIntune device compliance reportsCustom compliance in Intune: writing the discovery script and JSON rules 65009 Invalid JSON for the discovered settingIntune device compliance reportsCustom compliance in Intune: writing the discovery script and JSON rules 65010 Invalid datatype for the discovered settingIntune device compliance reportsCustom compliance in Intune: writing the discovery script and JSON rules -2016281112 (Remediation failed)Intune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes ADMX file referenced not found NamespaceMissing:Microsoft.Policies.Windows. Please upload it first.Intune admin center (Import ADMX)Importing custom ADMX templates into Intune: upload errors, dependencies and fixes Error code 0x80070005OneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders Error executing Checkupjournalctl -t mstunnel_monitorMicrosoft Tunnel for Intune: installation, mst-cli, health checks and connection errors Event ID 1001 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Event ID 1052 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Event ID 4001 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Event ID 4005 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Event ID 4007 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Event ID 5002 (CertificateConnectors)Event Viewer (Intune CertificateConnectors)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Failed to parse version-info.json for version information.journalctl -t mstunnel-agentMicrosoft Tunnel for Intune: installation, mst-cli, health checks and connection errors Failure starting service mstunnel-agentjournalctl -t mstunnel_monitorMicrosoft Tunnel for Intune: installation, mst-cli, health checks and connection errors Failure starting service mstunnel-serverjournalctl -t mstunnel_monitorMicrosoft Tunnel for Intune: installation, mst-cli, health checks and connection errors File exceeds the maximum file sizeOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders File exceeds the maximum path length in WindowsOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders Folder contains a reparse pointOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders GatewayTimeoutBrowser (SCEP server URL)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Has a compliance policy assignedDefault Device Compliance PolicyNoncompliant on the Default Device Compliance Policy? The three built-in checks explained HTTP Error 403.0 – ForbiddenBrowser (SCEP server URL)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune Important folders aren't in the default locationsOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders Last check-in: UnhealthyIntune admin center (Tunnel health check)Microsoft Tunnel for Intune: installation, mst-cli, health checks and connection errors main: tun.c:655: Can't open /dev/net/tun: Operation not permittedjournalctl -t ocserv (Tunnel server)Microsoft Tunnel for Intune: installation, mst-cli, health checks and connection errors MDM ConfigurationManager: Command failure status.DeviceManagement-Enterprise-Diagnostics-ProviderIntune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes No compliance policies have been assignedCompany PortalNoncompliant on the Default Device Compliance Policy? The three built-in checks explained Object reference not set to an instance of an objectIntune admin center (Import ADMX)Importing custom ADMX templates into Intune: upload errors, dependencies and fixes System.Text.Json.JsonException: The JSON value could not be converted to System.DateTimejournalctl -t mstunnel-agentMicrosoft Tunnel for Intune: installation, mst-cli, health checks and connection errors The file name isn't allowed in OneDriveOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders The folder isn't selected for syncingOneDrive (Known Folder Move dialog)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders TLS certificate revocation: WarningIntune admin center (Tunnel health check)Microsoft Tunnel for Intune: installation, mst-cli, health checks and connection errors

Security

BitLocker, Windows LAPS, Defender, Windows Hello for Business, EPM and Secure Boot

34
0x801C000E Registration quota reached.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0x801C03ED Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0x801C03F2 Windows Hello key registration failed.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0x801C044D Authorization token doesn't contain device ID.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0x80090029 TPM isn't set up.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0x80090035 Policy requires TPM and the device doesn't have TPM.Windows Hello PIN setupWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 0xC00000BB Your PIN or this option is temporarily unavailable.Windows sign-in with PINWindows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more 65000Intune admin center (Secure Boot profile)Rolling out the 2023 Secure Boot certificates with Intune before the last 2011 CA expires 65000Intune admin center (Secure Boot profile)Secure Boot certificate update not applying: registry values, event IDs and the Intune report DeviceDiagnosticDataNotReceivedIntune admin center (Secure Boot status report)Secure Boot certificate update not applying: registry values, event IDs and the Intune report Error: Unknown HResult Error code: 0x80072f8fEvent Viewer (BitLocker-API, event 846)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes Error: Unknown HResult Error code: 0x80072f9aEvent Viewer (BitLocker-API, events 846, 851)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes Event ID 40 (SENSE)Event Viewer (SENSE Operational)Windows 11 24H2 won't onboard to Defender for Endpoint: the missing Sense client (KB5043950) Event ID 778 (BitLocker-API)Event Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Event ID 846 (BitLocker-API)Event Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Event ID 851 (BitLocker-API)Event Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Event ID 853 (BitLocker-API)Event Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Event ID 854 (BitLocker-API)Event Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Event ID 1032Event Viewer (System log)Rolling out the 2023 Secure Boot certificates with Intune before the last 2011 CA expires Event ID 1801 (TPM-WMI)Event Viewer (System log)Rolling out the 2023 Secure Boot certificates with Intune before the last 2011 CA expires Event ID 1802Event Viewer (System log)Rolling out the 2023 Secure Boot certificates with Intune before the last 2011 CA expires Event ID 10005 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Event ID 10013 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Event ID 10025 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Event ID 10028 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Event ID 10032 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Event ID 10059 (LAPS)Event Viewer (LAPS Operational)Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Azure AD.Event Viewer (BitLocker-API, event 846)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Microsoft Entra ID.Event Viewer (BitLocker-API, event 846)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes No BitLocker key found for this deviceIntune admin center (Recovery keys)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes The BitLocker volume C: was reverted to an unprotected state.Event Viewer (BitLocker-API, event 778)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes the trust relationship between this workstation and the primary domain failedWindows sign-in screenDomain trust failures after KB5124008: Machine Identity Isolation explained for Intune admins UEFI variable 'SecureBoot' could not be readEvent Viewer (BitLocker-API Management)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Windows Hello for Business provisioning will not be launched.Event ID 360 (User Device Registration/Admin)Windows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more

Updates

Update rings, feature, quality and driver updates, and Windows Autopatch

2
Canceled: Not SupportedIntune (Windows Feature Update Report)Windows 11 feature update not offered by Intune? A troubleshooting checklist Code 10Device Manager (USB Audio Class 1.0 device)Rolling out Windows 11 26H2 with Intune: feature update policy, known issues, safeguard holds

Apple

iPhone, iPad and Mac: ADE, VPP, enrollment, Platform SSO, FileVault, apps and software updates

36
0x87D13B7DIntune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B7EIntune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B94Intune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B95Intune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B99Intune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13BA9Intune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D1313DIntune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D3012F The app couldn't be installed due to an internal error.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D3013B The app couldn't be installed to the Applications directory.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D3013E The DMG file doesn't contain any supported app.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D11388Intune admin center (Managed Apps)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D30131 The app couldn't be downloaded.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D30135 The app couldn't be installed due to a device error.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D30137 The device doesn't meet the minimum OS requirement set by the admin.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 0x87D30139 The DMG file couldn't be mounted for installation.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 2016214710 The preinstall script provided by the admin failed.Intune admin center (app install status)macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes 2016214828 The number of log files exceeded the allowed limit of 25 files.Collect logs (macOS script)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes 2016214831 The provided log file path must exist.Collect logs (macOS script)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes 2016214834 Log file size cannot exceed 60 MB.Collect logs (macOS script)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes -2016341107 / 0x87d1138dIntune admin center (FileVault policy status)FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D Access deniedIntune admin center (Enrollment program tokens)Apple ADE devices missing in Intune or stuck without an enrollment policy Awaiting final configurationSetup Assistant (iOS/iPadOS)Apple ADE devices missing in Intune or stuck without an enrollment policy bad interpreterTerminal (manual test run)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes command not foundTerminal (manual test run)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes Error 10001Intune admin center (Platform SSO policy)Platform SSO for macOS with Intune: setup, registration and troubleshooting Error 10002Intune admin center (Platform SSO policy)Platform SSO for macOS with Intune: setup, registration and troubleshooting Expired or invalid tokenIntune admin center (Enrollment program tokens)Apple ADE devices missing in Intune or stuck without an enrollment policy FileVault needs the user to approve their management profile in macOS Catalina and higher.Intune encryption report (Status details)FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D IT393575Microsoft 365 admin center (Service health)Macs unexpectedly unenrolled from Intune: the MDM certificate renewal issue and how to recover No new software available.Terminal (softwareupdate --list)macOS and iOS updates not installing in Intune: DDM settings, deadlines and fixes Operation not permittedTerminal (manual test run)macOS shell scripts and custom attributes not running in Intune: agent logs and fixes Terms and conditions not acceptedIntune admin center (Enrollment program tokens)Apple ADE devices missing in Intune or stuck without an enrollment policy The device is already encrypted. Device user must decrypt the device to continue.Intune encryption report (Status details)FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D The recovery key hasn't been retrieved and stored yet. Most likely, the device hasn't been unlocked, or it hasn't checked in.Intune encryption report (Status details)FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D The user is deferring encryption or is currently in the process of encryption.Intune encryption report (Status details)FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D Your Apple ID does not support the expected services on this deviceDevice (iOS/iPadOS)Account-driven User Enrollment for iOS/iPadOS BYOD with Intune: setup and user flow

Android & Linux

Android Enterprise work profile, fully managed and dedicated devices, and Linux

8
AADSTS53000 (DeviceNotCompliant)Microsoft Entra sign-in logAndroid fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in AADSTS53000: Device is not in required device state: compliantMicrosoft Edge / Microsoft Entra sign-in logLinux devices in Intune (Ubuntu, RHEL): enrollment, compliance and common errors Company Portal Temporarily UnavailableCompany Portal (Android)Android Enterprise work profile enrollment failures: what to check Contact your IT admin. This phone will be erased.Device (Android kiosk)Android Enterprise dedicated devices: Managed Home Screen kiosks and shared device sign-in Couldn't set up your device. For help, contact your IT admin.Android setup screenAndroid fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in DeviceCapReachedCompany Portal (Android)Android Enterprise work profile enrollment failures: what to check Something went wrongMicrosoft Intune app (device registration)Android fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in Unable to derive key material as unable to find the derivation key for aliasjournalctl (microsoft-identity-device-broker)Linux devices in Intune (Ubuntu, RHEL): enrollment, compliance and common errors

Jamf

Jamf Pro, Jamf Connect and their integrations with Intune and Microsoft Entra ID

53
1000 com.apple.AuthenticationServices.AuthorizationErrorMac sign-in (SSO extension)Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs 1001 UnexpectedMac sign-in (SSO extension)Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs 1012 NSURLErrorDomain errorMac sign-in (SSO extension)Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs [activated waiting for user]Terminal (systemextensionsctl list)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) AADSTS50011 InvalidReplyToJamf Connect login windowJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the applicationMicrosoft Entra sign-in pageJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS50020: User account '...' from identity provider '...' does not exist in tenant '...' and cannot access the applicationMicrosoft Entra sign-in pageJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS50076 UserStrongAuthClientAuthNRequiredMicrosoft Entra sign-in log (Interrupted)Jamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS50105 EntitlementGrantsNotFoundJamf Connect login windowJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS50105: The signed in user is not assigned to a role for the applicationMicrosoft Entra sign-in page / sign-in logJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS50126 InvalidUserNameOrPasswordJamf Connect / Microsoft Entra sign-in logJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS53000 DeviceNotCompliantJamf Connect login windowJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS53000: Device is not in required device state: compliant.Browser / Microsoft 365 app sign-inAADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access AADSTS53000: Device is not in required device state: compliant.Safari on a Jamf-managed iPhoneJamf Pro iPhone and iPad with Intune: device compliance and app protection (IntuneMAMUPN) AADSTS53001 (DeviceNotDomainJoined)Microsoft Entra sign-in logAADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access AADSTS53003 BlockedByConditionalAccessJamf Connect login windowJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS53003: Access has been blocked by Conditional Access policiesMicrosoft Entra sign-in logJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS65001 DelegationDoesNotExistJamf Connect login windowJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS65004 UserDeclinedConsentMicrosoft consent pageJamf Pro with Entra ID as cloud identity provider: setup, group lookups and Graph errors AADSTS700016: Application with identifier '...' was not found in the directory '...'Microsoft Entra sign-in pageJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.Entra sign-in log / ROPG testJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors Access deniedIntune ADE token syncMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Account not onboardedCompany PortalMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors AccountNotOnboardedCompany PortalSet up Jamf Pro Device Compliance with Microsoft Entra ID and Intune, step by step AccountNotOnboardedCompany PortalMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors AccountNotOnboardedCompany Portal (macOS)Jamf Device Compliance connector in Intune: partner status, permissions and sync errors Authorization_RequestDenied. Insufficient privileges to complete the operation.Microsoft Graph (HTTP 403 response)Jamf Pro with Entra ID as cloud identity provider: setup, group lookups and Graph errors Compliant: N/AMicrosoft Entra admin center (Devices)Jamf Device Compliance connector in Intune: partner status, permissions and sync errors Conditional Access Inventory State: UnresponsiveJamf Pro (legacy integration)Jamf Device Compliance connector in Intune: partner status, permissions and sync errors Device Compliance Integration - Registration Status: Not RegisteredJamf Pro (smart group criterion)Jamf Device Compliance connector in Intune: partner status, permissions and sync errors Device is already enrolledCompany PortalMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors Device is not in required device state: {state}. Conditional Access policy requires a compliant device, and the device is not compliant.Microsoft Entra sign-in logAADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access Error Domain=PlugInKit Code=16 "other version in use: ..."sysdiagnose (unified log)Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs Expired or invalid tokenIntune ADE token syncMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan full disk access has not been grantedTerminal (mdatp health)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) JamfAAD wants to access key "Microsoft Workplace Join Key" in your keychainmacOS keychain promptMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors Microsoft Defender needs attentionDefender app (macOS)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychainmacOS keychain promptMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychain.macOS keychain promptAADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access Need admin approvalMicrosoft consent pageJamf Pro with Entra ID as cloud identity provider: setup, group lookups and Graph errors network event provider not runningTerminal (mdatp health)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) no active event providerTerminal (mdatp health)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) No license foundDefender menu bar / mdatp healthDeploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) no WPJ key foundJamf Pro policy log (migration script)Migrating from the legacy Jamf macOS Intune integration to Jamf Pro Device Compliance NoEnrollmentPolicy (No enrollment policy found)iOS/iPadOS enrollmentMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Partner device management status: TerminatedIntune admin center (legacy connector)Jamf Device Compliance connector in Intune: partner status, permissions and sync errors Portal launched without WPJ only arg while account is under partner managementCompany Portal logMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors Profile Installation Failed. Connection to the server could not be established.iPhone/iPad enrollmentMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Profile Installation Failed. The new MDM payload does not match the old payload.iPhone/iPad enrollmentMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Registration-only command line flag (-r) can only be used when partner management is enabled in IntuneCompany PortalMac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors Sign in with your Microsoft account to get started.Defender app (macOS)Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors) Sign-in error code 530003: Device is required to be managed to access this resource.Microsoft Entra sign-in logPlatform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs Terms and conditions not acceptedIntune ADE token syncMigrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan

Integrations

Third-party connectors: threat defense, certificate authorities, ServiceNow, Samsung, Zebra, VPN and SIEM

27
0x87D1FDE8Intune admin center (per-setting status)Cisco, GlobalProtect, Zscaler and F5 VPN profiles in Intune: per-app VPN and errors 4009: the device does not support the OTA APIIntune admin center (FOTA device report)Zebra devices with Intune: LifeGuard OTA firmware updates, OEMConfig and errors to watch 2016281112 (Remediation Failed)Intune admin center (VPN profile status)Cisco, GlobalProtect, Zscaler and F5 VPN profiles in Intune: per-app VPN and errors AADSTS50105Microsoft Entra sign-in logFederating Apple Business Manager with Microsoft Entra ID: Managed Apple Accounts and sync AADSTS53000Microsoft Entra sign-in logThird-party compliance partners in Intune (Workspace ONE, Ivanti, Citrix): setup and fixes AADSTS53000 (DeviceNotCompliant)Microsoft Entra sign-in logAndroid zero-touch enrollment with Intune: reseller setup, DPC extras and common errors AADSTS53003 (BlockedByConditionalAccess)Microsoft Entra sign-in logFederating Apple Business Manager with Microsoft Entra ID: Managed Apple Accounts and sync AADSTS53003 (BlockedByConditionalAccess)Microsoft Entra sign-in logAndroid zero-touch enrollment with Intune: reseller setup, DPC extras and common errors AADSTS700016: Application with identifier '...' was not found in the directoryThird-party CA log (Entra token request)Intune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors AADSTS7000215: Invalid client secret provided.Service Graph Connector outbound HTTP logIntune ServiceNow connector: setup, incidents in the Troubleshooting pane and errors AADSTS7000215: Invalid client secret provided.Third-party CA log (Entra token request)Intune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors AADSTS7000222: The provided client secret keys for app '...' are expired.Third-party CA log (Entra token request)Intune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors Compliant: N/AMicrosoft Entra admin center (Devices)Third-party compliance partners in Intune (Workspace ONE, Ivanti, Citrix): setup and fixes Couldn't use the admin app due to a checksum errorAndroid setup screenAndroid zero-touch enrollment with Intune: reseller setup, DPC extras and common errors Error: Unable to make a connection to Intune via Graph API call. Please check your credential configuration.ServiceNow (Service Graph Connector import)Intune ServiceNow connector: setup, incidents in the Troubleshooting pane and errors Failed to createIntune admin center (FOTA deployments)Zebra devices with Intune: LifeGuard OTA firmware updates, OEMConfig and errors to watch Failed to resolve table or column expression named 'IntuneDevices'Log Analytics queryIntune diagnostic settings: send audit and device logs to Sentinel, Splunk or any SIEM IntuneScepServiceExceptionThird-party SCEP server logIntune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors Max allowed device threat levelApp protection policy (conditional launch)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors Need admin approvalMicrosoft sign-in (consent screen)Federating Apple Business Manager with Microsoft Entra ID: Managed Apple Accounts and sync No 'Access-Control-Allow-Origin' header is present on the requested resourceBrowser developer tools (Console)Intune ServiceNow connector: setup, incidents in the Troubleshooting pane and errors NOTAPPLICABLEIntune admin center (FOTA device report)Zebra devices with Intune: LifeGuard OTA firmware updates, OEMConfig and errors to watch partnerState: errorMicrosoft Graph (mobileThreatDefenseConnectors)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors partnerState: notSetUpMicrosoft Graph (mobileThreatDefenseConnectors)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors partnerState: unresponsiveMicrosoft Graph (mobileThreatDefenseConnectors)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors Require the device to be at or under the Device Threat LevelIntune admin center (device compliance)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors Serious Software ErrorSamsung COPE device (Android 15 / One UI 7)Samsung Knox Mobile Enrollment and Knox Service Plugin with Intune: setup and errors

Administration

RBAC, Graph automation, reporting, device actions, Remote Help, Windows 365 and service health

19
429 Too Many RequestsGraph response (Retry-After header)Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors 503 Service UnavailableGraph response (mobileApps listing)Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors AADSTS65001: The user or administrator has not consented to use the applicationConnect-MgGraph sign-inIntune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors Application is not authorized to perform this operationGraph response (403 Forbidden)Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors Azure network connection isn't healthyIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Device set to be hidden from admin by Device Cleanup RuleIntune admin center (Audit logs)Keeping Intune tidy: device cleanup rules and stale device hygiene Domain join failedIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Error code: ERROR_NOT_SUPPORTED (0x80070032)Autopilot Reset (device logs)Intune wipe, retire, Fresh Start and Autopilot Reset: what each removes and why they fail Group deleted from Microsoft Entra IDIntune admin center (Deployments)Intune deployments (preview): stage Win32 apps and policies across deployment rings HTTP 429Microsoft Graph API responseAutomating Intune device reports with Microsoft Graph PowerShell Insufficient privileges to complete the operation.Graph 403 (Authorization_RequestDenied)Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors Intune enrollment failedIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying InvalidAuthenticationTokenGraph response (401 Unauthorized)Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors License not found / User not found / Provisioning policy not foundIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Microsoft Entra hybrid join failedIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Microsoft Entra ID service connection point misconfiguredIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Not enough IP addresses availableIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying Remote Help isn't enabledRemote Help appRemote Help in Intune: licensing, setup, helper roles, deployment and troubleshooting Request disallowed by policyIntune admin center (All Cloud PCs)Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying

Windows enrollment error codes

Every code in the quick reference “Windows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference”: what it means, the usual cause and the first check. Open the quick reference

50
0x801C000E device registration quota reached (reported by admins)OOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x801c001d DSREG_AUTOJOIN_ADCONFIG_READ_FAILED: the service connection point couldn't be readdsregcmd /status / User Device RegistrationConfiguring Microsoft Entra hybrid join: SCP, targeted deployment and validation 0x801c001f DSREG_AUTOJOIN_DISC_WAIT_TIMEOUT: discovery timed outdsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x801c0002 DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError from the registration servicedsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x801c003a DSREG_DISCOVERY_TENANT_NOT_FOUND: wrong tenant ID in the SCP or no active subscriptiondsregcmd /status / User Device RegistrationConfiguring Microsoft Entra hybrid join: SCP, targeted deployment and validation 0x801c003d DSREG_AUTOJOIN_USERREALM_DISCOVERY_FAILED: realm discovery faileddsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x801c03f2 DSREG_E_DIRECTORY_FAILURE: DirectoryError, the device object isn't founddsregcmd /status / User Device RegistrationTroubleshooting Microsoft Entra hybrid join with dsregcmd /status 0x801c0006 DSREG_E_DEVICE_INTERNALSERVICE_ERROR: error response from the registration servicedsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x801c0021 DSREG_AUTOJOIN_DISC_FAILED: generic discovery failuredsregcmd /status / User Device RegistrationTroubleshooting Microsoft Entra hybrid join with dsregcmd /status 0x801c0025 DSREG_SERVER_BUSY: HTTP 503 from the device registration servicedsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80072ee2 WININET_E_TIMEOUT: network timeoutdsregcmd /status / User Device RegistrationTroubleshooting Microsoft Entra hybrid join with dsregcmd /status 0x80072ee7 WININET_E_NAME_NOT_RESOLVED: the server name couldn't be resolveddsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80072efd / 0x80072efe WININET_E_CANNOT_CONNECT / WININET_E_CONNECTION_ABORTEDdsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80072f8f WININET_E_DECODING_FAILED: the server response couldn't be decodeddsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8007000d E_INVALIDDATA: the server response couldn't be parseddsregcmd /status / User Device RegistrationTroubleshooting Microsoft Entra hybrid join with dsregcmd /status 0x8007064c The machine is already enrolled.Enrollment log / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018000A MENROLL_E_DEVICE_ALREADY_ENROLLED: The device is already enrolled.OOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x8018000B MENROLL_E_DEVICE_NOT_ENROLLED: the device isn't enrolledDeviceManagement-Enterprise-Diagnostics logCompany Portal for Windows: Sync fails, device not enrolled or assigned to someone else 0x8018000D MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID: certificate date invalid during discoveryOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018000F MENROLL_E_WAB_ERROR: error during web authentication broker enrollmentOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018001B MENROLL_E_PLATFORM_WRONG_STATE: invalid operation, such as enrolling twiceDeviceManagement-Enterprise-Diagnostics logWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018001C MENROLL_E_PLATFORM_LICENSE_ERROR: this Windows version doesn't support the enrollment typeOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018001E to 0x80180025 MENROLL_E_PROV_*: provisioning failed in a CSPDeviceManagement-Enterprise-Diagnostics logWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x8018002b Auto MDM Enroll: Failed (Group Policy automatic enrollment, event 76)DeviceManagement-Enterprise-Diagnostics logWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80090016 NTE_BAD_KEYSET: the TPM keyset doesn't existdsregcmd /status / User Device RegistrationTroubleshooting Microsoft Entra hybrid join with dsregcmd /status 0x80090031 NTE_AUTHENTICATION_IGNORED: the TPM is locked outdsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180001 MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR: invalid message format from the serverOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180002 MENROLL_E_DEVICE_AUTHENTICATION_ERROR: the server failed to authenticate the userOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180003 MENROLL_E_DEVICE_AUTHORIZATION_ERROR: the user isn't authorized to enrollOOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180005 / 0x80180006 / 0x80180008 MENROLL_E server errors: management server failure or unknown errorOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180009 MENROLL_E_ENROLLMENT_IN_PROGRESS: another enrollment is under wayDeviceManagement-Enterprise-Diagnostics logWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180010 MENROLL_E_CONNECTIVITY: network error such as DNS or a timeoutOOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180012 MENROLL_E_INVALIDSSLCERT: the SSL certificate wasn't validOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180013 MENROLL_E_DEVICECAPREACHED: the user has enrolled too many devicesOOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180014 MENROLL_E_DEVICENOTSUPPORTED: Your organization does not support this version of Windows.OOBE / Access work or schoolWindows Autopilot error 0x80180014 when redeploying a device: cause and fix 0x80180015 MENROLL_E_NOTSUPPORTED: MDM isn't supported on this deviceOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180016 MREGISTER_E_NOTELIGIBLETORENEW: the server rejected the MDM certificate renewalDeviceManagement-Enterprise-Diagnostics logIntune device not checking in: diagnosing a Windows device that stopped syncing 0x80180018 MENROLL_E_USERLICENSE: the user's licence state blocks enrollmentOOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180026 MENROLL_E_DEVICE_MANAGEMENT_BLOCKED: MDM enrollment was blockedOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180027 MENROLL_E_CERTPOLICY_PRIVATEKEYCREATION_FAILED: the private key couldn't be createdOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180029 MENROLL_E_EMPTY_MESSAGE: HTTP 200 with an empty messageOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180030 MENROLL_E_USER_CANCELED: the user canceled the operationOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180031 MENROLL_E_MDM_NOT_CONFIGURED: MDM isn't configuredOOBE / Access work or schoolWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80180032 The server responded with a custom error stringDeviceManagement-Enterprise-Diagnostics logWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference 0x80290407 / 0x80280036 TPM_E_PCP_INTERNAL_ERROR / TPM_E_NOTFIPS: TPM error or TPM in FIPS modedsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference A setup failure has occurred during bulk enrollment.Provisioning package (bulk enrollment)Windows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference AADSTS90002: Tenant UUID not found. (DirectoryError during sync-join)dsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference Looks like we can't connect to the URL for your organization's MDM terms of use.OOBE / Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where This account is not allowed on this phone.Access work or schoolWindows enrollment error 0x80180018 and its neighbours: what to check, and where Your request is throttled temporarily. Please try after 300 seconds.dsregcmd /status / User Device RegistrationWindows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference

Autopilot error codes

Every code in the quick reference “Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference”: what it means, the usual cause and the first check. Open the quick reference

43
0x801C03EA Registering your device for mobile management (Failed: 3, 0x801C03EA): TPM attestation failedESP (Registering for mobile management)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x801C03F3 Microsoft Entra device object not found (pre-provisioning)User Device Registration Admin logWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x800705B4 Securing your hardware (Failed: 0x800705b4): timeout, usually a device without TPM 2.0ESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x800706FD The trust relationship between this workstation and the primary domain failed.DeviceManagement-Enterprise-Diagnostics logPre-provisioning hybrid join fails when a policy needs a domain controller (0x800706FD) 0x8007202F A constraint violation occurred.ODJConnectorUI.log (connector setup)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x80004005 Hybrid join Autopilot deployments time outAutopilot / OOBE (hybrid join)Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix 0x80070032 ERROR_NOT_SUPPORTED: Autopilot Reset needs the Windows Recovery EnvironmentAutopilot Reset logsIntune wipe, retire, Fresh Start and Autopilot Reset: what each removes and why they fail 0x80070490 TPM attestation failure on AMD platforms with ASP firmware TPMESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x80070774 Something went wrong (hybrid join): the domain controller can't be found or reachedAutopilot / OOBE (hybrid join)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x80180014 Enrollment blocked for AP device by SDM One Time Limit CheckESP (Registering for mobile management)Windows Autopilot error 0x80180014 when redeploying a device: cause and fix 0x80180018 MENROLL_E_USERLICENSE: licence or device-count problem during AutopilotAutopilot / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where 0x80180022 Autopilot device enrollment failed: Windows Home editionAutopilot / OOBEWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x81039001 E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDEDESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x81039023 TPM attestation failure on Windows 11ESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0x81039024 TPM attestation failed: known TPM vulnerabilities detectedESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 0xc1036501 multiple MDM configurations in Microsoft Entra ID block automatic MDM enrollmentAutopilot / OOBEWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 806 - ZtdDeviceAlreadyAssigned: Device is already registered to the same Tenant.Intune admin center (Autopilot import)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference 808 - ZtdDeviceAssignedToOtherTenant: Internal errorIntune admin center (Autopilot import)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Another installation is in progress, please try again laterEnrollment Status PageEnrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide Autopilot reset ran into trouble. Could not find the recovery environmentAutopilot ResetWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Can't connect to the URL of your organization's MDM terms of use.Autopilot / OOBEWindows enrollment error 0x80180018 and its neighbours: what to check, and where Cannot convert the literal '[DEVICEHASH]' to the expected type 'Edm.Binary'Network trace (CSV import)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Cannot start service ODJConnectorSvc on computer '.'Intune Connector for AD setupIntune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA Event 100 Autopilot policy [name] not found.Autopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 163 AutopilotManager determined download isn't required and the device is already provisioned.Autopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 171 AutopilotManager failed to set TPM identity confirmed (event 172 follows)Autopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 807 ZtdDeviceIsNotRegisteredAutopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 809 ZtdDeviceHasNoAssignedProfile - Assigned profile does not exist.Autopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 815 ZtdDeviceHasNoAssignedProfile - No profile assigned to the device, and no default profile found in the tenant.Autopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 908 SerialNumberMismatch / ProductKeyIdMismatchAutopilot event log (ModernDeployment)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Event 2800 The following URI has triggered a rebootDeviceManagement-Enterprise-Diagnostics logEnrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide Event 30132 Failed to get the ODJ Blob. The ODJ connector does not have sufficient privileges to complete the operationODJConnectorService log (connector server)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Fix pending / Attention required: We've detected a hardware change on this device.Windows Autopilot devices (Intune)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference InstallationState 4 (Error): a Win32 app tracked by the ESP failedESP registry (EnrollmentStatusTracking)Enrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide MSA account <accountName> is not validIntune Connector for AD setupWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Navigation to the webpage was canceled / Can't connect securely to this pageIntune Connector for AD setupWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Preparing your device for mobile management (fails on an undersized VM)Autopilot / OOBEWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Ran into trouble. Please sign in with an administrator account to see why and reset manually.Autopilot ResetWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference SeLogonAsServicePrivilegeMissing (your own gMSA)Intune Connector for AD setupIntune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA Something happened, and TPM attestation timed out.ESP (Securing your hardware)Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference Something went wrong. OOBEIDPS.Autopilot / OOBEWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference That username looks like it belongs to another organization. Try signing in again or start over with a different accountAutopilot / OOBEWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference The MSA account couldn't be granted permission to create computer objects in the following OUsIntune Connector for AD setupWindows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference

App install error codes

Every code in the quick reference “Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference”: what it means, the usual cause and the first check. Open the quick reference

58
0x8A15001B APPINSTALLER_CLI_ERROR_MSSTORE_BLOCKED_BY_POLICY: The Microsoft Store client is blocked by policyIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A15001C APPINSTALLER_CLI_ERROR_MSSTORE_APP_BLOCKED_BY_POLICY: The Microsoft Store app is blocked by policyIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A15001E APPINSTALLER_CLI_ERROR_MSSTORE_INSTALL_FAILED: Failed to install the Microsoft Store appIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A150008 APPINSTALLER_CLI_ERROR_DOWNLOAD_FAILED: Downloading installer failedIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A150011 APPINSTALLER_CLI_ERROR_INSTALLER_HASH_MISMATCH: The installer file's hash does not match the manifestIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x8A150014 APPINSTALLER_CLI_ERROR_NO_APPLICATIONS_FOUND: No packages foundIntune admin center / WinGet logMicrosoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes 0x87D13B6F, 0x87D13B70, 0x87D13B72, 0x87D13B73, 0x87D13B77: app manifest validation failed on the networkIntune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B7D Unknown error (one documented cause: an expired VPP token)Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B7E License Assignment failed with Apple error 'No VPP licenses remaining'Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B7F Needed app configuration policy not present, ensure policy is targeted to same groups.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B8F The application is installed on the device but is unmanaged.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B9D The latest version of the app failed to update from an earlier version.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B60 The app is scheduled for installation, but needs a redemption code to complete the transaction.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B62 The user rejected the offer to install the app.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B63 The user rejected the offer to update the app.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B66 The app is managed, but has expired or been removed by the user.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B68 User declined app managementIntune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B80 CannotConnectToITunesStoreErrorIntune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B93 Can only install VPP apps on Shared iPad.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B94 Can't install apps when App Store is disabled.Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B95 Can't find VPP license for app.Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13B97 Can't install apps when device is in Lost Mode.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B98 Can't install apps when device is in kiosk mode.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D13B99 User must sign in to the App Store.Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D13BA9 The app installation has failed. (ErrorUserEnrollmentUnsupported)Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D300C9 The unmonitored process is in progress, however it may timeout.Intune admin center / Company PortalIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D1041C (Android device administrator): the user uninstalled a required appIntune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D1041C (iOS/iPadOS): app detection did not match the response from the deviceIntune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D1041C The application was not detected after installation completed successfully.Intune admin center (app install status)Win32 app error 0x87D1041C: the app installed but Intune can't detect it 0x87D1313C Network connection on the client was lost or interrupted.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D1313D Could not retrieve license for the app with iTunes Store IDIntune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D11388 iOS/iPadOS device is currently busy.Intune admin center (iOS app status)iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending 0x87D12906 Apple MDM Agent error: App installation command failed with no error reason specified.Intune admin center (iOS app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x87D30065 Failed to retrieve content information.Intune admin center (app install status)Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization 0x87D30067 Error unzipping downloaded content.Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x8000FFFF An unexpected error occurred during installation.Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80073CF0 The package could not be opened (unsigned, or publisher doesn't match the certificate)Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80073CF3 The package failed update, dependency, or conflict validation.Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80073CFB The provided package is already installed, and reinstallation of the package is blocked.Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80073CFF / 0x80CF201C To install this app, you must have a sideloading-enabled system.Intune admin center (app install status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80070642 (exit code 1602) ERROR_INSTALL_USEREXIT: the user canceled installationIntune admin center / AppWorkload.logIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80070643 (exit code 1603) ERROR_INSTALL_FAILURE: a fatal error occurred during installationIntune admin center / AppWorkload.logWin32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization 0x80070652 (exit code 1618) ERROR_INSTALL_ALREADY_RUNNING: another installation is already in progressIntune admin center / AppWorkload.logWin32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization 0x80070653 (exit code 1619) ERROR_INSTALL_PACKAGE_OPEN_FAILED: the package couldn't be openedIntune admin center / AppWorkload.logIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80070659 (exit code 1625) ERROR_INSTALL_PACKAGE_REJECTED: forbidden by system policyIntune admin center / AppWorkload.logIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80070666 (exit code 1638) ERROR_PRODUCT_VERSION: another version of this product is already installedIntune admin center / AppWorkload.logIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0x80070667 (exit code 1639) ERROR_INVALID_COMMAND_LINE: invalid command line argumentIntune admin center / AppWorkload.logIntune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB1 / 0xC7D14FB9 The end user canceled the app installation.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB2 / 0xC7D15078 The download failed because of an unknown error.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB5 The app failed to install.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB6 The app installation APK file cannot be installed because it was not signed.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB7 The app installation APK file used for the upgrade does not match the signature for the current appIntune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FB8 The app failed to uninstall.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FBA The app installation was canceled because the installation (APK) file was deleted after downloadIntune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D14FBB / 0xC7D14FBC Installation or uninstall canceled because the process was restartedIntune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 0xC7D15015 / 0xC7D1507C The file download process (or service) was unexpectedly stopped.Intune admin center (Android app status)Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference 1641 ERROR_SUCCESS_REBOOT_INITIATED: success, the installer has initiated a restartAppWorkload.log (installer exit code)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules 3010 ERROR_SUCCESS_REBOOT_REQUIRED: success, a restart is required to complete the installAppWorkload.log (installer exit code)Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules

Entra sign-in (AADSTS) errors

Every code in the quick reference “Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference”: what it means, the usual cause and the first check. Open the quick reference

42
AADSTS50005 DevicePolicyError: platform not supported by a Conditional Access policyMicrosoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50011 InvalidReplyTo: reply address is missing, misconfigured or doesn't match the app's reply addressesSign-in page (Jamf Connect, Jamf Pro SSO)Jamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS50020 UserUnauthorized: account from another tenant can't access the appSign-in pageJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS50034 UserAccountNotFound: the account isn't in this directorySign-in page / Microsoft Entra sign-in logPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts AADSTS50053: account locked (IdsLocked) or sign-in from a malicious IP addressSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50055 / AADSTS50144: password expired (cloud or on-premises Active Directory)Sign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50057 UserDisabled: the user account is disabledSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50058 UserInformationNotProvided: session information isn't sufficient for single sign-onMicrosoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50072 UserStrongAuthEnrollmentRequiredInterrupt: user must register for MFASign-in page / sign-in log (Interrupted)AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50074 UserStrongAuthClientAuthNRequiredInterrupt: MFA required and not yet passedMicrosoft Entra sign-in log (Interrupted)AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50076 UserStrongAuthClientAuthNRequired: the user must use MFA for this resourceMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50078 UserStrongAuthExpired: presented MFA has expired under your policiesMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50079 UserStrongAuthEnrollmentRequired: MFA required, security info not registeredSign-in page / Microsoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50097 DeviceAuthenticationRequired: device authentication is requiredMicrosoft Entra sign-in log (Interrupted)Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50105 EntitlementGrantsNotFound: user isn't assigned to a role for the appSign-in page / Microsoft Entra sign-in logJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS50126 InvalidUserNameOrPassword: invalid username or passwordSign-in page / dsregcmd /statusPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts AADSTS50127 BrokerAppNotInstalled: user needs to install a broker appSign-in page (mobile) / sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50129 DeviceIsNotWorkplaceJoined: workplace join is requiredSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50131 ConditionalAccessFailed: Conditional Access error such as a bad Windows device stateMicrosoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50132 / AADSTS50133: session invalid after a password expiry or changeSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50140 KmsiInterrupt: Keep me signed in interruptMicrosoft Entra sign-in log (Interrupted)Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50155 DeviceAuthenticationFailed: device authentication failed for this userSign-in log / dsregcmd /statusPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts AADSTS50158: external security challenge not satisfiedMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS50168: Windows 10 Accounts extension present but no valid SSO token in the requestMicrosoft Entra sign-in log (Interrupted)Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50173: the grant was revoked and a fresh auth token is neededApp sign-in / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50187 DeviceInformationNotProvided: the service failed to perform device authenticationMicrosoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50194: app isn't multitenant, so the /common endpoint isn't supportedSign-in page / app or tool errorMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS50199 CmsiInterrupt: user confirmation required for this requestMicrosoft Entra sign-in log (Interrupted)Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS53000 DeviceNotCompliant: Conditional Access requires a compliant deviceSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks AADSTS53001 DeviceNotDomainJoined: policy requires a domain-joined deviceSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks AADSTS53002 ApplicationUsedIsNotAnApprovedApp: app isn't approved for Conditional AccessSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS53003 BlockedByConditionalAccess: a policy doesn't allow token issuanceSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks AADSTS53004 ProofUpBlockedDueToRisk: MFA registration needed but blocked by riskSign-in page / Microsoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors AADSTS53010 ProofUpBlockedDueToSecurityInfoAcr: security info must be set from specific locations or devicesSecurity info registration / sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS65001 DelegationDoesNotExist: no consent for the applicationSign-in page (Jamf Connect login window)Jamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors AADSTS70043 BadTokenDueToSignInFrequency: refresh token expired by sign-in frequencyMicrosoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS135011: Device used during the authentication is disabledEvent Viewer (AAD Operational) / sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS500121: Authentication failed during strong authentication requestSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS501241: mandatory input missing from transformation (NameID source attribute)Sign-in page (SAML app)Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS700016 UnauthorizedClient_DoesNotMatchRequest: application not found in the directorySign-in page / Microsoft Entra sign-in logJamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors AADSTS700082 ExpiredOrRevokedGrantInactiveToken: refresh token expired due to inactivityApp sign-in / Microsoft Entra sign-in logMicrosoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference AADSTS7000218: request body must contain 'client_assertion' or 'client_secret'Microsoft Entra sign-in log / ROPG testJamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors

Profile & compliance error codes

Every code in the quick reference “Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference”: what it means, the usual cause and the first check. Open the quick reference

50
0x87D1FDE8 (-2016281112) Remediation failedIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D1FDE9 (-2016281111) Not applicable for this deviceIntune admin center (profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D1FDEA (-2016281110) Invalid parameter to CIM settingIntune admin center (profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D1FDEB (-2016281109) Data type conversion failedIntune admin center (custom profile)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D1FDEE (-2016281106) Not applicable because it lost in conflict resolutionIntune admin center (profile status)Finding and fixing Intune policy conflicts with the MDM diagnostic report 0x87D1FDEF (-2016281105) Failed to evaluate the RuleIntune admin center (profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D1FDF0 (-2016281104) MDM CI certificate info not foundIntune admin center (certificate profile)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D1FDF1 (-2016281103) MDM CRP certificate info not foundIntune admin center (certificate profile)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D1FDF2 (-2016281102) NDES URL not foundIntune admin center (SCEP profile)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D1FDF3 (-2016281101) MDM CRP request not foundIntune admin center (certificate profile)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D17D05 (-2016314107) 22005: Network error (SCEP payload)Intune admin center (iOS profile status)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D101A9 (-2016345687) Syncml (425): sender does not have adequate access control permissions (ACL)Intune admin center (profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D101F4 (-2016345612) Syncml (500): The recipient encountered an unexpected conditionIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D136B0 (-2016332112) 4000: Cannot parse profileIntune admin center (iOS profile status)iOS/iPadOS configuration profiles failing in Intune: supervision, errors and conflicts 0x87D136B4 (-2016332108) 4004: User canceled installationIntune admin center (iOS profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D136B5 (-2016332107) 4005: Passcode does not complyIntune admin center (iOS profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D161A8 (-2016321112) 15000: Cannot install VPNIntune admin center (iOS profile status)Cisco, GlobalProtect, Zscaler and F5 VPN profiles in Intune: per-app VPN and errors 0x87D1791D (-2016315107) 21005: Account not unique (Email Profile already exists on device)Intune admin center (iOS profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D10194 (-2016345708) Syncml (404): The requested target was not found.Intune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D10195 (-2016345707) Syncml (405): The requested command is not allowed on the target.Intune admin center (profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D10196 (-2016345706) Syncml (406): an optional feature in the request was not supportedIntune admin center (profile status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes 0x87D10837 (-2016344009) (1403): Certificate not foundIntune admin center (profile status)Wi-Fi or VPN profile not applying? Troubleshoot the SCEP/PKCS certificate chain in Intune 0x87D11388 (-2016341112) iOS device is currently busyIntune admin center (iOS profile status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference 0x87D19858 (-2016307112) 29000: Device not supervisedIntune admin center (iOS profile status)iOS/iPadOS configuration profiles failing in Intune: supervision, errors and conflicts 65000: per-setting form of 0x87D1FDE8 Remediation failed (0xFDE8 = 65000)Intune admin center (per-setting status)Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes A TPM isn't available for BitLocker (not present, made unavailable in the Registry, or OS on a removable drive)Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Antivirus / Antispyware: Not compliant (disabled or out of date)Intune admin center (device compliance)Defender Antivirus settings not applying from Intune: a troubleshooting checklist Encryption of data storage on a device: Not compliantIntune admin center (device compliance)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Enrolled user exists: Not compliantDefault Device Compliance PolicyNoncompliant on the Default Device Compliance Policy? The three built-in checks explained Error (compliance setting): state kept up to 7 days, then Not compliantIntune admin center (per-setting status)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference Firewall: Error (sync right after restart or wake) or Not compliant (GPO)Intune admin center (device compliance)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference Has a compliance policy assigned: Not compliantDefault Device Compliance PolicyNoncompliant on the Default Device Compliance Policy? The three built-in checks explained In grace period: noncompliant, but inside the admin-defined grace periodIntune admin center (compliance report)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference Is active: Not compliantDefault Device Compliance PolicyNoncompliant on the Default Device Compliance Policy? The three built-in checks explained Not compliant: device failed one or more compliance settingsIntune admin center (device compliance)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference Not evaluated: no compliance result yet (new, userless or not checked in)Intune admin center (compliance report)Noncompliant on the Default Device Compliance Policy? The three built-in checks explained Pending: device hasn't checked in to receive or report compliance statusIntune admin center (compliance report)Intune device not checking in: diagnosing a Windows device that stopped syncing Recovery key backup failed.Intune admin center (Encryption report)BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes Require BitLocker: Not compliant (health attestation, measured at boot)Intune admin center (device compliance)Intune health attestation is moving to Azure Attestation: prepare before compliance breaks Require code integrity: Not compliantIntune admin center (device compliance)Intune health attestation is moving to Azure Attestation: prepare before compliance breaks Require Secure Boot to be enabled on the device: Not compliantIntune admin center (device compliance)Intune health attestation is moving to Azure Attestation: prepare before compliance breaks Require the device to be at or under the machine risk score: Not compliantIntune admin center (device compliance)Noncompliant on the Defender "machine risk score" setting: the end-to-end checklist The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.Intune admin center (Encryption report)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard ... but the user didn't consent.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes The encryption method of the OS volume doesn't match the BitLocker policy.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes The OS volume is unprotected.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes The TPM isn't ready for BitLocker.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes To encrypt drives, the BitLocker policy requires ... the AllowStandardUserEncryption policy must be set to 1.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes Trusted Platform Module (TPM): Not compliant (no TPM version)Intune admin center (device compliance)Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference Windows Recovery Environment (WinRE) isn't configured.Intune admin center (Encryption report)BitLocker silent encryption not starting on Intune-managed devices: causes and fixes

Apple enrollment & MDM errors

Every code in the quick reference “iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference”: what it means, the usual cause and the first check. Open the quick reference

36
Access denied: Intune can't talk to Apple (MDM server removed or token expired)Intune admin center (enrollment program token)Apple ADE devices missing in Intune or stuck without an enrollment policy Account not onboarded: Company Portal not opened from Jamf Self Service (Jamf-managed Mac)Company Portal (macOS, Jamf)Mac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors AccountNotOnboarded: Apple MDM push (APNs) certificate not set up or expired (iOS/iPadOS)Company Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference An error occurred while uploading the Enrollment Program token. (AjaxError: ajaxExtended call failed)Intune admin center (token upload)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference APNSCertificateNotValid: problem with the certificate that lets the device talk to your company's networkCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Apple profile not found: ADE enrollment profile not found (several possible causes)Intune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Company Portal Temporarily Unavailable: app out of date or corrupted, or the device limit was reachedCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Cursor expired: ADE sync cursor expired on Intune's sideIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Device is already enrolled: earlier Intune registration not cleaned up (Jamf-managed Mac)Company Portal (macOS, Jamf)Mac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors DeviceCapReached: Too many mobile devices are enrolled alreadyCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference DeviceTypeNotSupported: the device type you're trying to enroll isn't supportedCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference error code:-25244 (errSecInvalidOwnerEdit): stale or corrupted Intune keychain entriesCompany Portal log (macOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Expired or invalid token: ADE token expired, revoked or malformedIntune admin center (enrollment program token)Apple ADE devices missing in Intune or stuck without an enrollment policy Internal server error: ADE token sync needs investigation by Intune supportIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Invalid configuration profile name: ADE enrollment profile name invalid, empty or too longIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Invalid cursor: ADE sync cursor rejected by Apple or not foundIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Invalid department entry: the ADE enrollment profile's department field is invalidIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Invalid support phone number: the ADE enrollment profile's support phone number is invalidIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference It looks like you're using a virtual machine. Make sure you've fully configured your virtual machine...Company Portal (macOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Looks like your IT admin hasn't set an MDM authority. Get help from your IT admin or try again later.Company PortaliPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference MdmAuthorityNotDefined: the mobile device management authority hasn't been definedCompany PortaliPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference NoEnrollmentPolicy: No enrollment policy found (APNs certificate missing, invalid or expired)Company Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Profile Installation Failed. A Network Error Has Occurred. (iOS/iPadOS problem on the device)iPhone/iPad (Settings)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Profile Installation Failed. Connection to the server could not be established.iPhone/iPad (Settings)Migrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Profile Installation Failed. The new MDM payload does not match the old payload. (profile already installed)iPhone/iPad (Settings)Migrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan Profile installation failed: management profile didn't install (licence, other MDM, old profile, Safari cookies)iPhone/iPad (Settings)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Required cursor: ADE sync cursor wasn't initially set by IntuneIntune admin center (enrollment program token)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Terms and conditions not accepted: new Apple Business or Apple School Manager termsIntune admin center (enrollment program token)Apple ADE devices missing in Intune or stuck without an enrollment policy The configuration for your iPhone/iPad couldn't be downloaded from <Company Name>: Invalid ProfileiPhone/iPad (enrollment)Apple ADE devices missing in Intune or stuck without an enrollment policy User Name Not Recognized. This user account isn't authorized to use Microsoft Intune. (no Intune licence)Company Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference UserLicenseTypeInvalid: user not in a required group or missing the correct licenceCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference We're having trouble getting your device managed. (VM, restricted serial number or device assigned to someone else)Company Portal (macOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Workplace Join failed: Company Portal app out of date or corruptedCompany Portal (iOS/iPadOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference XPC_TYPE_ERROR Connection invalid: the device can't reach Apple's ADE serviceiPhone/iPad device log (ADE Setup Assistant)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Your IT admin hasn't given you access to use this app. Get help from your IT admin or try again later. (no licence)Company PortaliPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference Your Mac cannot be enrolled at this time: Company Portal enrollment failed (check the log for -25244)Company Portal (macOS)iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference

Android enrollment & management errors

Every code in the quick reference “Android Enterprise enrollment and management errors in Intune: a quick reference”: what it means, the usual cause and the first check. Open the quick reference

40
AADSTS53000 DeviceNotCompliant in the Chrome tab during corporate-owned setupMicrosoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks Block USB debugging on device: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Check strong integrity: Not compliant (device fails or doesn't support the check)Intune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Company Portal app runtime integrity or Intune app runtime integrity: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Company Portal Temporarily UnavailableCompany Portal (enrollment)Android Enterprise work profile enrollment failures: what to check DeviceCapReachedCompany Portal (enrollment)Android Enterprise work profile enrollment failures: what to check Google Play Services is configured: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Looks like your IT admin hasn't set an MDM authority. Get help from your IT admin or try again later.Company PortalAndroid Enterprise enrollment and management errors in Intune: a quick reference Maximum OS version: access blocked, user asked to contact ITIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference MDM authority not definedCompany Portal (enrollment)Android Enterprise enrollment and management errors in Intune: a quick reference Minimum OS version: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Minimum security patch level: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Not evaluated: dedicated device compliance policy targeted at usersIntune admin center (compliance report)Android Enterprise dedicated devices: Managed Home Screen kiosks and shared device sign-in Play Integrity Verdict (Check basic integrity & device integrity): Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Play Integrity Verdict (Check basic integrity): Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Profile installation failedAndroid device (enrollment)Android Enterprise enrollment and management errors in Intune: a quick reference Require the device to be at or under the Device Threat Level: Not compliantIntune admin center (device compliance)Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors Require the device to be at or under the machine risk score: Not compliantIntune admin center (device compliance)Noncompliant on the Defender "machine risk score" setting: the end-to-end checklist Rooted devices: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Symptom: Android 12+ users must update the device password (Password complexity)Android device / complianceAndroid Enterprise enrollment and management errors in Intune: a quick reference Symptom: can't create a work profileCompany Portal (work profile setup)Android Enterprise work profile enrollment failures: what to check Symptom: can't create policy or enroll devices (special characters in the company name)Intune admin center / enrollmentAndroid Enterprise enrollment and management errors in Intune: a quick reference Symptom: dedicated device users can't sign in to Conditional Access-protected resourcesMicrosoft Entra sign-in logAndroid Enterprise dedicated devices: Managed Home Screen kiosks and shared device sign-in Symptom: device not grouped at enrollment (staging token doesn't support enrollment time grouping)Intune admin center (enrollment profile)Android fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in Symptom: device passcode reset not supported (work profile devices)Intune admin center (device actions)Intune wipe, retire, Fresh Start and Autopilot Reset: what each removes and why they fail Symptom: dynamic group on enrollmentProfileName stays empty (default enrollment profile)Microsoft Entra ID (dynamic group)Dynamic device groups for Intune: membership rules that actually work Symptom: encryption is required when a device is enrolled (expected)Android device (work profile setup)Android Enterprise work profile enrollment failures: what to check Symptom: enrollment fails because Google Play services is out of dateAndroid device (enrollment)Android Enterprise enrollment and management errors in Intune: a quick reference Symptom: enrollment token no longer works (revoked, replaced or expired staging token)Android setup (QR code or token entry)Android fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in Symptom: enrollments fail after an assigned enrollment profile was renamedAndroid setupAndroid fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in Symptom: Google Play Protect settings fail where Google Mobile Services isn't availableIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Symptom: Managed Google Play Last Sync time hasn't been updated in days (expected)Intune admin center (Managed Google Play)Android Enterprise enrollment and management errors in Intune: a quick reference Symptom: Microsoft Authenticator can't be uninstalled on fully managed devices (expected)Android deviceAndroid Enterprise enrollment and management errors in Intune: a quick reference Symptom: registration lost or marked noncompliant (Company Portal earlier than 5.0.5421.0)Company Portal / compliance reportAndroid Enterprise enrollment and management errors in Intune: a quick reference Symptom: Wipe (Factory Reset) option isn't available for a work profile device (expected)Intune admin center (device actions)Intune wipe, retire, Fresh Start and Autopilot Reset: what each removes and why they fail Symptom: work profile can't be set up where Android Enterprise isn't availableCompany Portal (work profile setup)Android Enterprise enrollment and management errors in Intune: a quick reference Symptom: work profile enrollment from a secondary user account (not supported)Company Portal (work profile setup)Android Enterprise work profile enrollment failures: what to check Symptom: zero-touch or Knox Mobile Enrollment still uses an old tokenZero-touch portal / Knox Mobile EnrollmentAndroid zero-touch enrollment with Intune: reseller setup, DPC extras and common errors Up-to-date security provider: Not compliantIntune admin center (device compliance)Android Enterprise enrollment and management errors in Intune: a quick reference Your IT admin hasn't given you access to use this app. Get help from your IT admin or try again later.Company PortalAndroid Enterprise enrollment and management errors in Intune: a quick reference
All 112 guides

Every Intune guide, by area

Troubleshooting guides, how-tos, deep dives and code references for Microsoft Intune, Windows Autopilot, Apple, Android, Jamf and third-party integrations.

All Intune guides

Enrollment 5

Autopilot 10

Apps & scripts 13

Policies & compliance 14

Security 10

Updates 5

Apple 11

Android & Linux 5

Jamf 16

Integrations 11

Administration 12

Suggest a topic

Hit an Intune error that isn't here?

Send me the exact code or message and what you were doing — the most-requested errors become the next guides in this library.

Email me Message me on LinkedIn