← cd ~/events
// events/76 · Intune MDM
Event ID 76Auto MDM Enroll: Failed
Automatic MDM enrolment failed. The commonly seen code 0x8018002b means the UPN uses an unverified or non-routable suffix (such as .local) or the MDM user scope is None.
| Log | Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin |
|---|---|
| Source | DeviceManagement-Enterprise-Diagnostics-Provider |
| Area | Intune MDM |
What to check
Check the user's UPN suffix is verified in Entra ID and the MDM user scope includes the user. For Autopilot hybrid devices, check whether the associated Entra device was deleted.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0x8018002b | Unverified or non-routable UPN suffix, or MDM user scope set to None. |
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; Id = 76 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" and EventID == 76
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Intune MDM events
- Event ID 75: Auto MDM Enroll: Succeeded
- Event ID 306: SCEP certificate profile received (CspExecute)
- Event ID 400: MDM ConfigurationManager: Command failure status
- Event ID 401: MDM ConfigurationManager: CSP Node Operation
- Event ID 1506: WiFiConfigurationServiceProvider: Node set value
- Event ID 107: Auto-enrolment task triggered
- Event ID 102: Auto-enrolment task completed
- Event ID 7016: Auto-enrolment task did not start