Intune Device Enrollment Failure Troubleshooting Guide
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Microsoft Intune device enrollment failures block zero-touch provisioning and delay workforce onboarding. This guide covers the most common error codes, ESP timeouts, hybrid join failures, and certificate enrollment gaps, with diagnostic commands and portal-based verification steps. For hybrid Azure AD join issues, see the Entra ID hybrid join troubleshooting guide.
Reading the Enrollment Status Page and MDM Diagnostic Report
The Enrollment Status Page (ESP) is the first place to look when Autopilot provisioning stalls. When ESP times out, it shows the last tracking phase: Device preparation, Device setup, or Account setup. Each phase maps to a different failure class. Download the MDM Diagnostic Report from Settings > Accounts > Access work or school > Export your management log files. The report at C:\Users\Public\Documents\MDMDiagnostics\MDMDiagReport.html contains the actual enrollment error code, the MDM URL that failed, and the timestamp. For silent failures on corporate-owned devices provisioned via pre-provisioned Autopilot, check the Windows event log under Applications and Services > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
Fixing Error 0x80180014: License Assignment and Enrollment Restrictions
Error 0x80180014 means the enrolling user has no Intune license assigned at the time of enrollment. Verify via Microsoft 365 admin center > Users > Active users > find the user > Licenses and apps. Even if the user has a Microsoft 365 E3 or E5 license, the Intune component must be enabled within the license. For bulk provisioning, use group-based licensing: assign the license to a security group that all Autopilot users belong to. Wait up to 30 minutes after license assignment before retrying enrollment. If using device-based enrollment with no user affinity, the device itself must have a license assigned in the enrollment restrictions profile under Intune > Devices > Enrollment > Enrollment restrictions > Device type restrictions.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Fixing Error 0x80180026: Enrollment Profile Conflicts and Device Limits
Error 0x80180026 occurs when enrollment restrictions block the device. Check Intune > Devices > Enrollment > Enrollment restrictions for both device type restrictions and device limit restrictions. If the user already has the maximum number of enrolled devices, the new enrollment is rejected. Increase the device limit or unenroll stale devices first. For device type restrictions, verify that the Windows platform is set to Allow and that personally owned device restrictions do not apply to corporate devices. Corporate devices are identified by the device serial number being present in the Windows Autopilot device identities list. If a serial number is missing, import it via Intune > Devices > Enrollment > Windows enrollment > Devices before retrying.
Troubleshooting Autopilot Profile Not Found (0x80070774)
Error 0x80070774 during pre-provisioned Autopilot means the device cannot retrieve its Autopilot profile from Windows Autopilot deployment service. First, verify network connectivity: the device must reach *.ztd.dds.microsoft.com and *.login.microsoftonline.com during the OOBE phase. Second, confirm the device hash is registered in Intune > Devices > Enrollment > Windows enrollment > Devices and that a deployment profile is assigned to the correct group containing this device. Profile assignment happens via dynamic device groups using the enrollmentProfileName attribute. Check that the group membership evaluates correctly for the device using Azure AD > Groups > the group > Members. Profile sync can take up to 15 minutes after hash import.
Resolving Hybrid Azure AD Join and Certificate Enrollment Failures
Hybrid Azure AD join requires the device to reach a domain controller during OOBE, which makes it sensitive to network path and DNS configuration. The Intune Connector for Active Directory must be installed on a domain-joined server with line-of-sight to both Azure and on-premises DCs. Verify the connector is healthy under Intune > Devices > Enrollment > Windows enrollment > Intune Connector for Active Directory. For certificate enrollment failures, check that the SCEP or PKCS certificate profile is targeted to the device group, that the NDES server is reachable, and that the Intune Certificate Connector logs at C:\Program Files\Microsoft Intune\NDESConnectorSvc show no authentication errors. SCEP challenge password expiry is a common cause: the NDES server reuses the same challenge for 60 minutes by default.
Verifying Enrollment Health with Intune Portal and MDM Logs
After resolving the root cause, verify enrollment success in Intune > Devices > All devices. The device should appear with a compliance status of Compliant or Pending within 15 minutes of successful enrollment. Use the Intune troubleshooting blade (Troubleshooting + support > Troubleshoot) to look up the user and confirm device appears under their enrolled devices. For ongoing monitoring, create a Workbook or alert in Azure Monitor that fires when enrollment failure events spike. The MDM event source in Azure AD sign-in logs (filtered by Application: Microsoft Intune Enrollment) shows every enrollment attempt and the specific failure reason code. Export this data to Sentinel for correlation with identity events if you need a persistent record.
The bottom line
Track enrollment health in the Intune admin center under Devices > Monitor > Enrollment failures. Set up diagnostic alerts for repeated 0x8018 error codes, and review the MDM Diagnostic Report on affected devices before escalating to Microsoft support. Address license assignment gaps and enrollment restriction mismatches first; they account for the majority of first-attempt failures.
Frequently asked questions
What does Intune error code 0x80180014 mean and how do I fix it quickly for a user who cannot enroll?
0x80180014 means the enrolling user has no Intune license. Assign an Intune or Microsoft 365 E3/E5 license in the Microsoft 365 admin center, enable the Intune component within the license, and wait 30 minutes before retrying enrollment. For bulk provisioning, use group-based licensing.
Why does the Enrollment Status Page time out during Windows Autopilot provisioning and how do I extend the timeout threshold?
ESP times out when apps or policies take longer than the configured threshold to install. Increase the timeout in Intune > Devices > Enrollment > Windows enrollment > Enrollment Status Page > Edit. Set the timeout to 60 or 90 minutes for environments with many required apps. Identify the blocking app by reviewing MDMDiagReport.html on a failed device.
How do I diagnose hybrid Azure AD join failures that block Intune enrollment for domain-joined devices?
Run dsregcmd /status on the device and check AzureAdJoined and DomainJoined values. For failures during OOBE, verify the Intune Connector for Active Directory is healthy in Intune and that the connector server has line-of-sight to on-premises domain controllers. Check connector logs at C:\Program Files\Microsoft Intune\ODJConnectorSvc for authentication errors.
What is Intune enrollment error 0x80180026 and why does it appear for new device enrollments even with correct licenses?
0x80180026 is an enrollment restriction violation. The device is hitting a device type restriction or device limit restriction in Intune > Devices > Enrollment > Enrollment restrictions. Check whether the user already has the maximum allowed enrolled devices, or whether the device is classified as personally owned when it should be corporate-owned based on the Autopilot device list.
How can I verify that an Intune device enrollment completed successfully and all policies are applied?
In the Intune admin center, go to Devices > All devices and confirm the device appears with a Compliant status. Click the device and check Device configuration, Compliance policies, and App install status tabs. Use the Troubleshooting blade to confirm all assigned profiles show Succeeded. Run mdmdiagnosticstool.exe -area DeviceEnrollment -cab on the device for a full diagnostic dump.
What causes certificate enrollment failures during the Intune MDM enrollment process and how do I resolve them?
Certificate enrollment failures usually stem from an unreachable NDES server, an expired SCEP challenge password, or a misconfigured PKCS certificate profile. Verify the Intune Certificate Connector is healthy, check that the NDES server URL in the SCEP profile is reachable from the device, and review connector logs at C:\Program Files\Microsoft Intune\NDESConnectorSvc\Logs for authentication or connectivity errors.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.