Co-management troubleshooting checklist

Symptoms to confirm

• A pilot device is missing from the Intune admin center, or shows ConfigMgr (tenant attach) rather than Co-managed under Managed by.
• The Monitoring › Co-management dashboard shows devices pending or failed, with enrollment errors.
• The device logs event ID 76: Auto MDM Enroll: Failed (Unknown Win32 Error code: 0x...).
• Access work or school says Sync wasn't fully successful because we weren't able to verify your credentials.
• The device is co-managed, but Intune policies for one area never apply.

Likely causes

A device is only co-managed when every link in this chain holds:

• Microsoft notes that most issues come from a setup step that was skipped or not completed, so check configuration before you blame the device.

Checklist

1. 1

   Prove the client has the co-management policy

   Open %WinDir%\CCM\Logs\CoManagementHandler.log in CMTrace or OneTrace. A device that has the policy but hasn't enrolled yet logs entries like these:

   Auto enrollment agent is initialized.
   Device is not enrolled.
   AAD-Join Info: type = 1 DeviceId = '<device ID>' TenantId = '<tenant ID>' ... EnrollmentUrl = 'https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc'
   Device is not MDM enrolled yet. All workloads are managed by SCCM.
   Value of CoManagementFlags retrieved: 0x2001
   There is no scheduled tasks under "EnterpriseMgmt"

2. 2

   Confirm the device is hybrid joined

   Run dsregcmd /status. You need AzureAdJoined : YES as well as DomainJoined : YES.

3. 3

   Read the MDM enrollment events

   The real error code is in Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin, where event 75 means a successful automatic enrollment and event 76 a failure. Token problems appear alongside them in Microsoft › Windows › AAD › Operational.

   powershell

   Get-WinEvent -LogName 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin' -MaxEvents 300 |
     Where-Object Id -in 75, 76 | Format-List TimeCreated, Id, Message

   Code	What it means	Fix
   0x8018002b	MDM isn't configured: MDM user scope is None (or excludes the user), or the UPN uses an unverified or non-routable suffix such as .local	Set the scope in Entra ID › Mobility (MDM and MAM) › Microsoft Intune; give users a verified, routable UPN suffix
   0x80180018	The user's licence state blocks enrollment	Assign an Intune licence; see 0x80180018 and its neighbours
   0x80180014	A platform restriction blocks Windows (MDM)	Allow Windows (MDM) in the default restriction, the only one device-token enrollment uses
   0x8018002a	The AAD log also shows AADSTS50076 / 0xCAA2000C (interaction required). Legacy per-user MFA set to Enforced blocks enrollment with the signed-in user's credentials	Don't leave per-user MFA Enforced for these users, or use trusted IPs during enrollment
   0x80180023 with 0x800706D9	The dmwappushservice service is missing	Import HKLM\SYSTEM\CurrentControlSet\Services\dmwappushservice from a healthy device on the same Windows version, restart and re-register

4. 4

   Re-trigger enrollment

   Nothing needs rebuilding: the policy retries at its next evaluation. To hurry a test device along, request machine policy, evaluate the CoMgmtSettings baseline and watch the log:

   powershell

   Invoke-CimMethod -Namespace root\ccm -ClassName SMS_Client -MethodName TriggerSchedule `
     -Arguments @{ sScheduleID = '{00000000-0000-0000-0000-000000000021}' }
   Get-Content "$env:WinDir\CCM\Logs\CoManagementHandler.log" -Tail 30 -Wait

5. 5

   Check which authority owns the workload

   If a co-managed device ignores an Intune policy, check the workload first. In the co-management properties, each workload is set to Configuration Manager, Pilot Intune or Intune.

   • A device must be enrolled and in the workload's pilot collection. If it's in a staging collection but not in Intune Auto Enrollment, it never switches.
   • Value of CoManagementFlags retrieved is a bitmask of the workloads handed to Intune. Don't decode it by hand: compare it with a healthy pilot device. If it doesn't change after you move a slider, the device hasn't picked up the new policy yet.
   • Exception: a baseline set to Always apply this baseline even for co-managed clients keeps applying after device configuration moves to Intune.

Verify

• Event 75 (Auto MDM Enroll: Succeeded) is logged and no new event 76 follows.
• CoManagementHandler.log no longer reports Device is not MDM enrolled yet, and Task Scheduler has an enrollment folder under Microsoft › Windows › EnterpriseMgmt.
• Sync on the work account's Info page completes without a credentials error.
• Intune shows the device as Co-managed with a fresh check-in.

Key takeaways

• Check the chain in order (policy, join, enrollment, workloads) and fix the first broken link.
• CoManagementHandler.log shows what the client is attempting. Event 76 shows why enrollment failed.
• Before you widen the pilot, confirm the default enrollment restriction allows Windows (MDM) and the MDM user scope covers your users.
• Keep Intune Auto Enrollment as the superset collection, and build each workload's pilot collection from it.