// tools/intune-errors

Intune and Autopilot error codes

Search 116 error codes from Intune app installs, Windows enrolment and Autopilot. Type the hex code (0x87D1041C), the decimal value some logs show (-2016345060) or a word from the message.

Error code or keyword

116 codes

0x8000FFFFApp install-2147418113

An unexpected error occurred during installation.
Check: Check the installation logs on the device for more detail.
Microsoft source ↗
0x80073CF0App install-2147009296

The Windows app package could not be opened. It may be unsigned, or the publisher name does not match the signing certificate subject.
Check: Check the AppxPackagingOM event log, and confirm the package is signed and the publisher matches the certificate subject.
Microsoft source ↗
0x80073CF3App install-2147009293

The Windows app package failed update, dependency or conflict validation, for example a conflicting installed package, a missing dependency or the wrong processor architecture.
Check: Check the AppXDeployment-Server event log for the specific validation failure.
Microsoft source ↗
0x80073CFBApp install-2147009285

The package is already installed and reinstallation is blocked, usually because a rebuilt or re-signed package is not identical to the installed one.
Check: Increment the app version and rebuild and re-sign the package, or remove the old package for every user before installing the new one.
Microsoft source ↗
0x80073CFFApp install-2147009281
(client error)
The Windows app needs a sideloading-enabled system to install.
Check: Make sure the package is signed with a trusted signature and the device has the AllowAllTrustedApps policy enabled (domain-joined or with a sideloading licence).
Microsoft source ↗
0x80CF201CApp install-2133909476
(client error)
The Windows app needs a sideloading-enabled system to install.
Check: Make sure the package is signed with a trusted signature and the device has the AllowAllTrustedApps policy enabled (domain-joined or with a sideloading licence).
Microsoft source ↗
0x87D103E8App install-2016345112
Unknown error
An unknown app installation error occurred when no other error applied.
Check: Retry the installation and collect device logs if it persists.
Microsoft source ↗
0x87D1041CApp install-2016345060
The application was not detected after installation completed successfully.
Intune installed the app, but it is no longer detected. The user may have uninstalled it, the package identity does not match what the device reports, or a self-updating MSI changed version outside Intune.
Check: Ask the user to reinstall from Company Portal (required apps reinstall at the next check-in), and check the app's detection details match what is actually installed.
Microsoft source ↗
0x87D11388App install-2016341112
iOS/iPadOS device is currently busy.
iOS/iPadOS: the device was busy (locked), so the app could not install.
Check: The user needs to unlock the device for the app to install.
Microsoft source ↗
0x87D12906App install-2016335610
Apple MDM Agent error: App installation command failed with no error reason specified.
iOS/iPadOS: the Apple MDM agent reported the installation command failed without a reason.
Check: Retry the app installation.
Microsoft source ↗
0x87D1313CApp install-2016333508
Network connection on the client was lost or interrupted.
iOS/iPadOS: the network connection was lost while the download service URL was sent to the device (host not found).
Check: Retry when the device has a better network connection.
Microsoft source ↗
0x87D1313DApp install-2016333507
Could not retrieve license for the app with iTunes Store ID
iOS/iPadOS: Intune could not get a VPP licence for the app.
Check: Sync the VPP token then the device. If it persists, reassign as device-licensed, revoke and reassign the licence, or revoke all VPP licences for the device and re-enrol.
Microsoft source ↗
0x87D13B62App install-2016330910
The user rejected the offer to install the app.
iOS/iPadOS: the user tapped Cancel at the initial install prompt.
Check: Ask the user to accept the install request next time.
Microsoft source ↗
0x87D13B63App install-2016330909
The user rejected the offer to update the app.
iOS/iPadOS: the user tapped Cancel during the update.
Check: Deploy the app as required or ask the user to accept the update prompt.
Microsoft source ↗
0x87D13B64App install-2016330908
The app installation has failed.
iOS/iPadOS: an app installation failure occurred.
Check: Collect the iOS/iPadOS console logs to troubleshoot.
Microsoft source ↗
0x87D13B66App install-2016330906
The app is managed, but has expired or been removed by the user.
iOS/iPadOS: the user uninstalled the app, the app expired but failed to download, or detection does not match the response from the device.
Check: Check whether the user removed the app and re-push it. Confirm the app is still valid and downloadable.
Microsoft source ↗
0x87D13B68App install-2016330904
User declined app management
iOS/iPadOS: the user declined to let the app be managed.
Check: Ask the user to accept app management.
Microsoft source ↗
0x87D13B6FApp install-2016330897
Your connection to Intune timed out.
iOS/iPadOS: app manifest validation failed because of a network timeout.
Check: Check network connectivity on the device and retry.
Microsoft source ↗
0x87D13B7DApp install-2016330883
Unknown error.
iOS/iPadOS: an unknown app installation error. One known cause is an expired VPP token in Intune.
Check: Check that the Apple VPP token is current and working.
Microsoft source ↗
0x87D13B7EApp install-2016330882
License Assignment failed with Apple error 'No VPP licenses remaining'
iOS/iPadOS: there are no VPP licences left to assign. This is by design.
Check: Buy more VPP licences or reclaim licences from users who are no longer targeted.
Microsoft source ↗
0x87D13B7FApp install-2016330881
Needed app configuration policy not present, ensure policy is targeted to same groups.
iOS/iPadOS: the app requires an app configuration policy but none is targeted.
Check: Target the required app configuration policy to the same groups as the app.
Microsoft source ↗
0x87D13B80App install-2016330880
CannotConnectToITunesStoreError
iOS/iPadOS: the app install failed because the device could not connect to the iTunes Store.
Check: Check the device can reach the App Store and retry.
Microsoft source ↗
0x87D13B8FApp install-2016330865
The application is installed on the device but is unmanaged.
iOS/iPadOS LOB app: the app was installed outside Intune.
Check: Uninstall the app from the device. Intune will install the managed copy at the next sync.
Microsoft source ↗
0x87D13B95App install-2016330859
Can't find VPP license for app.
iOS/iPadOS: no VPP licence was found for the app.
Check: Try revoking and reassigning the app licence.
Microsoft source ↗
0x87D13B9DApp install-2016330851
The latest version of the app failed to update from an earlier version.
iOS/iPadOS: the app is installed and managed but at the wrong version, for example the update command has been sent but the new version has not yet been reported.
Check: Wait for the device to report the new version, which clears the error, or investigate any different error it fails with.
Microsoft source ↗
0x87D13B9EApp install-2016330850
Can't enforce app uninstall setting. Retry installing the app.
iOS/iPadOS: the app is installed but its "uninstall on retire" setting does not match the configured value.
Check: Ask the user to request the app from Company Portal so the setting can be applied again.
Microsoft source ↗
0x87D13B9FApp install-2016330849
The VPP App has an update available
iOS/iPadOS: the VPP app is installed but a newer version is available.
Check: No error as such. The app will update when the newer version is deployed.
Microsoft source ↗
0x87D13BA2App install-2016330846
One or more apps contain invalid bundleIDs.
A macOS LOB package contains several apps and not all of them report installation status back to Intune, so it shows as failed even if the app installed.
Check: Run "sudo /usr/libexec/mdmclient QueryInstalledApps" on a Mac with the app, remove any included apps in the Intune app information that are not in that list, save and sync.
Microsoft source ↗
0x87D13BA9App install-2016330839
The app installation has failed. (ErrorUserEnrollmentUnsupported)
A VPP app is deployed with device licensing, but account-driven Apple User Enrollment (BYOD) only supports user licensing.
Check: Change the assignment licensing type to user licensing, or create a separate assignment for these users.
Microsoft source ↗
0xC7D14FB1App install-942583887
The end user canceled the app installation.
Android (DA): the user cancelled or clicked away from the OS install prompt.
Check: Ask the user not to cancel the install. Intune shows a notification so they can retry.
Microsoft source ↗
0xC7D14FB2App install-942583886
The download failed because of an unknown error.
Android (DA): the APK download failed, commonly because of Wi-Fi issues or a slow connection.
Check: Retry from the notification once the device has a reliable connection.
Microsoft source ↗
0xC7D14FB5App install-942583883
The app failed to install.
Android (DA/Knox): Intune cannot find the root cause. The APK downloaded but did not install, often a bad APK, Google Play Protect blocking it, or the device not supporting the app.
Check: Check the APK is valid and supports the device's Android API level, and whether Play Protect blocked it.
Microsoft source ↗
0xC7D14FB7App install-942583881
The app installation APK file used for the upgrade does not match the signature for the current app on the device.
Android: the upgrade APK is signed with a different certificate from the installed version.
Check: Sign the new version with the same certificate, or uninstall the existing app and deploy the new one instead of upgrading.
Microsoft source ↗
0xC7D14FBBApp install-942583877
The app installation was canceled because the process was restarted during installation.
Android (DA/Knox): the device rebooted during APK installation.
Check: Retry from the Intune notification.
Microsoft source ↗
0xC7D15015App install-942583787
The file download process was unexpectedly stopped.
Android (DA): the OS stopped the download, for example on low battery or because it took too long.
Check: Make sure the device has a reliable network connection and retry.
Microsoft source ↗
0x80004005Autopilot-2147467259

Microsoft Entra hybrid join Autopilot deployments can time out with this generic error during the deployment.
Check: Install the fix: KB5065789 or later for 25H2, KB5065426 or later for 24H2, or KB5070312 or later for 23H2.
Microsoft source ↗
0x80070490Autopilot-2147023728

TPM attestation failed on AMD platforms using the ASP firmware TPM (fTPM).
Check: Update to a later AMD firmware version. Check the device manufacturer's firmware release notes.
Microsoft source ↗
0x800705B4Autopilot-2147023436
Securing your hardware (Failed: 0x800705b4)
A general timeout. In self-deploying mode it is commonly because the device is not TPM 2.0 capable, for example a virtual machine.
Check: Use a device with a physical TPM 2.0 for self-deploying mode or pre-provisioning. Virtual TPMs and TPM 1.2 are not supported.
Microsoft source ↗
0x800706FDAutopilot-2147023107
The trust relationship between this workstation and the primary domain failed.
Hybrid join pre-provisioning fails when a policy (for example a User Rights setting) needs domain controller connectivity during the technician flow and the device has no line of sight to a DC.
Check: Do not assign policies needing domain controller connectivity during the technician flow, or pre-provision on a network that can reach a domain controller.
Microsoft source ↗
0x80070774Autopilot-2147022988
Something went wrong... error code 80070774
Hybrid Autopilot fails because the domain controller cannot be reached or the device cannot join the domain. Common causes are using Assign user with a hybrid join profile, a deleted Entra device object, or wrong OU permissions for the Intune Connector.
Check: Unassign the user from the Autopilot device, check the ODJ connector log for event 30132 and delegate Create/Delete computer objects on the OU to the connector server. If the Entra device was deleted, remove and reimport the hardware hash.
Microsoft source ↗
0x8007202FAutopilot-2147016657
A constraint violation occurred." (DirectoryServicesCOMException)
Known issue with the Intune Connector for Active Directory version 6.2501.2000.5 when creating computer objects for hybrid Autopilot.
Check: See the Intune Connector for Active Directory guidance in the Windows Autopilot troubleshooting FAQ for the mitigation.
Microsoft source ↗
0x80180014Autopilot-2145910764
Enrollment blocked for AP device by SDM One Time Limit Check" (DeviceNotSupported)
Re-enrolment of a previously enrolled device is blocked. Either the Intune device record from an earlier self-deploying or pre-provisioning run still exists, or Windows MDM enrolment is blocked by a platform restriction.
Check: In Intune go to Devices > Windows > Enrollment > Windows Autopilot > Devices, select the device and choose Unblock device, then redeploy. Also check that Windows (MDM) is set to Allow in device platform restrictions.
Microsoft source ↗
0x80180022Autopilot-2145910750
Autopilot device enrollment failed with error HRESULT = 0x80180022
Autopilot enrolment failed because the device being provisioned is running Windows Home edition.
Check: Upgrade the device to Pro edition or higher.
Microsoft source ↗
0x801C03EAAutopilot-2145647638
Registering your device for mobile management (Failed: 3, 0x801C03EA)
TPM attestation failed, so the device could not join Microsoft Entra ID with a device token. The TPM supports 2.0 but has not been upgraded to it.
Check: Upgrade the TPM to version 2.0. If it persists, make sure the device is not in two groups with different Autopilot profiles assigned.
Microsoft source ↗
0x801C03F3Autopilot-2145647629

Pre-provisioning shows an error because Microsoft Entra ID cannot find the device object, typically because it was deleted manually.
Check: Remove the device from Entra ID, Intune and Windows Autopilot, then re-register it with Autopilot to recreate the Entra device object.
Microsoft source ↗
0x81039001Autopilot-2130472959
E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDED
TPM attestation intermittently failed during the Securing your hardware step of pre-provisioning or self-deploying mode.
Check: Retry provisioning. Subsequent attempts might succeed.
Microsoft source ↗
0x81039023Autopilot-2130472925

TPM attestation failed on Windows 11 during pre-provisioning or self-deploying mode.
Check: Apply the May 2022 cumulative update for Windows 11 21H2 (KB5013943) or later to the device.
Microsoft source ↗
0x81039024Autopilot-2130472924

TPM attestation failed on Windows 11 because known vulnerabilities were detected in the TPM.
Check: Update the TPM firmware from the PC manufacturer's website.
Microsoft source ↗
0xC1036501Autopilot-1056742143

The device cannot do automatic MDM enrolment because there are multiple MDM configurations in Microsoft Entra ID.
Check: Review Microsoft Entra ID > Mobility (MDM and MAM) so that only one MDM application applies to the users being enrolled.
Microsoft source ↗
0x8007064CEnrollment-2147023284
The machine is already enrolled.
Enrolment fails because the computer was previously enrolled, was built from a cloned image of an enrolled computer, or still holds the previous account certificate.
Check: Delete the Intune certificate issued by Sc_Online_Issuing from the computer Personal store and the HKLM\SOFTWARE\Microsoft\OnlineManagement registry key (back up the registry first), then try to enrol again.
Microsoft source ↗
0x800706D9Enrollment-2147023143
MDM Enroll: OMA-DM client configuration failed. RAWResult: (0x800706D9)
Seen alongside 0x80180023 when a Microsoft Entra hybrid joined device fails to enrol because the dmwappushservice service is missing.
Check: Restore the dmwappushservice service registry key from a working device on the same Windows version, restart, then re-register the device and update Group Policy.
Microsoft source ↗
0x80090016Enrollment-2146893802
NTE_BAD_KEYSET / "Keyset does not exist
Device registration could not save the device key because the TPM keys were not accessible, usually because Windows is not the owner of the TPM.
Check: Clear the TPM (Windows Security > Device security > Security processor details > Security processor troubleshooting) and restart the device.
Microsoft source ↗
0x80090031Enrollment-2146893775
NTE_AUTHENTICATION_IGNORED
The TPM is locked out (anti-hammering) during device registration.
Check: This is transient. Wait for the TPM cool-down period and the join should succeed afterwards.
Microsoft source ↗
0x80180001Enrollment-2145910783
MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR
Invalid schema or message format error returned from the server during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180002Enrollment-2145910782
MENROLL_E_DEVICE_AUTHENTICATION_ERROR
The MDM server failed to authenticate the user during enrolment.
Check: Confirm the user is signing in with the correct work account. Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180003Enrollment-2145910781
This user is not authorized to enroll.
The user is not allowed to enrol. Causes include reaching the device enrolment limit, a device platform restriction blocking Windows (MDM), Windows Home edition, or users not being allowed to join devices to Microsoft Entra ID.
Check: Remove unused devices or raise the device limit, set Windows (MDM) to Allow in enrolment restrictions, upgrade Home to Pro or higher, and check that "Users may join devices to Microsoft Entra ID" allows the user.
Microsoft source ↗
0x80180004Enrollment-2145910780
MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR
The user has no permission for the certificate template or the certificate authority is unreachable.
Check: Check the user's permissions on the certificate template and that the certificate authority is reachable.
Microsoft source ↗
0x80180005Enrollment-2145910779
MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR
There was a failure at the management server, such as a database access error.
Check: This is a server-side failure. Retry the enrolment later and check the service health in the Intune admin centre if it persists.
Microsoft source ↗
0x80180006Enrollment-2145910778
MENROLL_E_DEVICE_INTERNALSERVICE_ERROR
There was an unhandled exception on the management server.
Check: This is a server-side failure. Retry the enrolment later and check the service health in the Intune admin centre if it persists.
Microsoft source ↗
0x80180008Enrollment-2145910776
MENROLL_E_DEVICE_UNKNOWN_ERROR
Unknown server error during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180009Enrollment-2145910775
MENROLL_E_ENROLLMENT_IN_PROGRESS
Another enrolment operation is already under way on the device.
Check: Wait for the current enrolment to finish, then retry. Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x8018000AEnrollment-2145910774
The device is already enrolled.
The device is already enrolled. Usually a different user has already enrolled the device in Intune or joined it to Microsoft Entra ID.
Check: Sign in as the account that enrolled or joined the device, remove the work or school account under Settings > Accounts > Access work or school, then sign in with your own account and enrol again.
Microsoft source ↗
0x8018000BEnrollment-2145910773
MENROLL_E_DEVICE_NOT_ENROLLED
The device is not enrolled, so an operation that needs an existing enrolment could not run.
Check: Confirm the device enrolment state under Settings > Accounts > Access work or school and enrol the device if needed.
Microsoft source ↗
0x8018000EEnrollment-2145910770
MENROLL_E_PASSWORD_NEEDED
A password is needed for enrolment but was not supplied.
Check: Retry the enrolment and complete the sign-in prompt with the user's credentials.
Microsoft source ↗
0x80180010Enrollment-2145910768
MENROLL_E_CONNECTIVITY
A network error occurred during enrolment, such as a DNS failure or a network timeout.
Check: Check DNS resolution, proxy and firewall access to the Intune enrolment endpoints, then retry.
Microsoft source ↗
0x80180012Enrollment-2145910766
MENROLL_E_INVALIDSSLCERT
The SSL certificate presented during enrolment was not valid.
Check: Check that nothing on the network path is presenting a different certificate for the enrolment endpoints. Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180013Enrollment-2145910765
MENROLL_E_DEVICECAPREACHED
The user has already enrolled too many devices.
Check: Delete or unenrol old devices for the user (the user can do this without admin help), or raise the device limit restriction.
Microsoft source ↗
0x80180015Enrollment-2145910763
MENROLL_E_NOTSUPPORTED
Mobile device management is not supported for this device.
Check: The device cannot be MDM enrolled as it stands. Check the Windows edition and version are supported for Intune enrolment.
Microsoft source ↗
0x80180017Enrollment-2145910761
MENROLL_E_INMAINTENANCE
The account is in maintenance.
Check: Retry the enrolment later.
Microsoft source ↗
0x80180018Enrollment-2145910760
Something went wrong.
Enrolment in Intune or another MDM fails. Common causes are incorrect or missing licences assigned to the user, or too many devices enrolled for the user.
Check: Check the user has the correct Intune licence assigned and has not reached the device enrolment limit.
Microsoft source ↗
0x80180019Enrollment-2145910759
MENROLL_E_ENROLLMENTDATAINVALID
The server rejected the enrolment data. The server may not be configured correctly.
Check: The server may not be configured correctly. Check the MDM application settings under Microsoft Entra ID > Mobility (MDM and MAM). Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x8018001BEnrollment-2145910757
MENROLL_E_PLATFORM_WRONG_STATE
An invalid operation was attempted, such as trying to enrol the same device twice or unenrol an unknown device.
Check: Check whether the device is already enrolled under Settings > Accounts > Access work or school before retrying.
Microsoft source ↗
0x8018001CEnrollment-2145910756
MENROLL_E_PLATFORM_LICENSE_ERROR
The version (edition) of Windows installed on the device does not support this enrolment type.
Check: Upgrade the device to a Windows edition that supports the enrolment type, such as Pro or higher.
Microsoft source ↗
0x8018001DEnrollment-2145910755
MENROLL_E_PLATFORM_UNKNOWN_ERROR
An unknown error occurred on the client during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x8018001EEnrollment-2145910754
MENROLL_E_PROV_CSP_CERTSTORE
Provisioning failed in the certificate store CSP during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180020Enrollment-2145910752
MENROLL_E_PROV_CSP_DMCLIENT
Provisioning failed in a DM client CSP during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180021Enrollment-2145910751
MENROLL_E_PROV_CSP_PFW
Provisioning failed in a Passport for Work (Windows Hello for Business) CSP during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180023Enrollment-2145910749
MDM Enroll: Provisioning failed
Enrolment of a Microsoft Entra hybrid joined device failed because the dmwappushservice service is missing from the device. Often logged together with 0x800706D9.
Check: Export HKLM\SYSTEM\CurrentControlSet\Services\dmwappushservice from a working device on the same Windows version, import it on the affected device, restart, remove the old Entra registration and run a Group Policy update.
Microsoft source ↗
0x80180024Enrollment-2145910748
MENROLL_E_PROV_SSLCERTNOTFOUND
When binding the public certificate to the private key during provisioning, the public certificate was not found.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180025Enrollment-2145910747
MENROLL_E_PROV_CSP_APPMGMT
Provisioning failed in the EnterpriseAppManagement CSP during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180026Enrollment-2145910746
Something went wrong. Confirm you are using the correct sign-in information...
Joining a Windows device to Microsoft Entra ID fails because MDM automatic enrolment is enabled and the legacy Intune PC software client (PC agent) is installed on the device.
Check: Either uninstall the Intune PC software client from the computer, or set MDM user scope to None under Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune.
Microsoft source ↗
0x80180027Enrollment-2145910745
MENROLL_E_CERTPOLICY_PRIVATEKEYCREATION_FAILED
The device failed to create the private key during enrolment.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180028Enrollment-2145910744
MENROLL_E_CERTAUTH_FAILED_TO_FIND_CERT
Certificate authentication was requested, but the device failed to find a certificate to use.
Check: Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x80180029Enrollment-2145910743
MENROLL_E_EMPTY_MESSAGE
The server responded with HTTP 200, but the message was empty.
Check: Retry the enrolment. Check the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device for the failing step and retry the enrolment.
Microsoft source ↗
0x8018002AEnrollment-2145910742
Auto MDM Enroll: Failed (Unknown Win32 Error code: 0x8018002a)
Microsoft Entra hybrid joined (co-managed) devices fail to auto-enrol because per-user MFA is set to Enforced, which stops the Configuration Manager client enrolling with the signed-in user's credentials.
Check: Set per-user MFA to Enabled rather than Enforced, or temporarily bypass MFA during enrolment using Trusted IPs.
Microsoft source ↗
0x8018002BEnrollment-2145910741
Auto MDM Enroll: Failed" (Event ID 76)
Automatic MDM enrolment through Group Policy failed. The user UPN uses an unverified or non-routable domain (such as .local), or MDM user scope is set to None.
Check: Give affected users a valid, verified UPN suffix and let Microsoft Entra Connect sync, or set MDM user scope to All or Some under Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune.
Microsoft source ↗
0x80180030Enrollment-2145910736
MENROLL_E_USER_CANCELED
The user cancelled the enrolment operation.
Check: Ask the user to restart the enrolment and complete all prompts.
Microsoft source ↗
0x80180031Enrollment-2145910735
MENROLL_E_MDM_NOT_CONFIGURED
Mobile device management is not configured.
Check: Check that Microsoft Intune is configured as the MDM application under Microsoft Entra ID > Mobility (MDM and MAM) with the correct MDM user scope.
Microsoft source ↗
0x801C0002Enrollment-2145648638
DSREG_E_DEVICE_AUTHENTICATION_ERROR
The device registration service returned an AuthenticationError (with a sub-code other than DeviceNotFound).
Check: Check the server error code in the User Device Registration Admin event log for the specific reason.
Microsoft source ↗
0x801C0003Enrollment-2145648637
This user is not authorized to enroll.
The same user-not-authorised condition as 0x80180003: device limit reached, platform restriction, Windows Home edition, or Entra device join not permitted for the user.
Check: Remove unused devices or raise the device limit, allow Windows (MDM) in enrolment restrictions, upgrade from Home edition, and allow the user to join devices to Microsoft Entra ID.
Microsoft source ↗
0x801C0006Enrollment-2145648634
DSREG_E_DEVICE_INTERNALSERVICE_ERROR
The device registration service returned an error response during registration.
Check: Check the server error code in the User Device Registration Admin event log for the specific reason.
Microsoft source ↗
0x801C001DEnrollment-2145648611
DSREG_AUTOJOIN_ADCONFIG_READ_FAILED
Hybrid join could not read the service connection point (SCP) object to get the Microsoft Entra tenant information.
Check: Check the service connection point is configured correctly for Microsoft Entra hybrid join.
Microsoft source ↗
0x801C0021Enrollment-2145648607
DSREG_AUTOJOIN_DISC_FAILED
Generic discovery failure: the device could not get discovery metadata from the device registration service (DRS).
Check: Look at the sub-error (often a network code such as 0x80072EE2) to find the underlying cause.
Microsoft source ↗
0x801C03F2Enrollment-2145647630
DSREG_E_DIRECTORY_FAILURE
Microsoft Entra hybrid join failed with a DirectoryError, typically "The public key user certificate is not found on the device object". The device object is missing in Entra ID or its userCertificate attribute is not populated.
Check: Make sure the userCertificate attribute is populated on the on-premises computer object and synced. If missing, run dsregcmd /leave, delete the MS-Organization-Access certificate, restart, then run a delta sync.
Microsoft source ↗
0x80280036Enrollment-2144862154
TPM_E_NOTFIPS
Automatic device registration failed because the TPM has FIPS mode enabled, which is not supported for Azure device registration.
Check: Do not use FIPS mode on the TPM for devices that need to register with Microsoft Entra ID.
Microsoft source ↗
0x80290407Enrollment-2144795641
TPM_E_PCP_INTERNAL_ERROR
Generic TPM error during Microsoft Entra hybrid join.
Check: Disable the TPM on affected devices. Windows 10 1809 and later detect TPM failures and complete hybrid join without the TPM.
Microsoft source ↗
0x80CF4017Enrollment-2133901289
The software cannot be installed" / "The account certificate is not valid and may be expired
The legacy Intune PC client software on the device is out of date.
Check: Download the current client software from the admin console (Admin > Client Software Download) and install it.
Microsoft source ↗
0xCAA2000CEnrollment-895352820
The request requires user interaction." (interaction_required)
Logged in the Microsoft Entra ID Operational log when MFA blocks the token needed for automatic enrolment or MDM sync of a co-managed device (AADSTS50076).
Check: Remove per-user MFA enforcement or use Trusted IPs, or exclude the Microsoft Intune app (0000000a-0000-0000-c000-000000000000) from Conditional Access policies that require MFA.
Microsoft source ↗
0xCAA9001FEnrollment-894894049
Integrated Windows authentication supported only in federation flow.
MDM enrolment of co-managed, hybrid joined devices fails because the Configuration Manager client tried integrated Windows authentication against Entra ID while the domain is not federated.
Check: Configure Azure Services for Cloud Management in Configuration Manager and enable both AD User Discovery and Microsoft Entra user Discovery for the users.
Microsoft source ↗
0x8007065DOther-2147023267
E_DATATYPE_MISMATCH
The data type does not match the expected data type.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x80072EE2Other-2147012894
WININET_E_TIMEOUT
General network timeout, for example while discovering or registering the device with the device registration service.
Check: Check network connectivity to https://enterpriseregistration.windows.net and the other required Microsoft endpoints.
Microsoft source ↗
0x80072EFDOther-2147012867
WININET_E_CANNOT_CONNECT
A connection with the server could not be established.
Check: Check network connectivity to the required Microsoft endpoints.
Microsoft source ↗
0x80072F8FOther-2147012721
WININET_E_DECODING_FAILED
The network stack could not decode the server response.
Check: Make sure a network proxy is not interfering with or modifying the server response.
Microsoft source ↗
0x87D10190Other-2016345712
Syncml(400)
OMA-DM status 400: the command could not be performed because of malformed syntax.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D10194Other-2016345708
Syncml(404)
OMA-DM status 404: the requested target (setting node) was not found on the device.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D10195Other-2016345707
Syncml(405)
OMA-DM status 405: the requested command is not allowed on the target.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D10196Other-2016345706
Syncml(406)
OMA-DM status 406: an optional feature in the request was not supported.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D1019COther-2016345700
Syncml(412)
OMA-DM status 412: the command failed because it was incomplete or incorrectly formed.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D101A2Other-2016345694
Syncml(418)
OMA-DM status 418: the Put or Add command failed because the target already exists.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D101A9Other-2016345687
Syncml(425)
OMA-DM status 425: the sender does not have adequate access control permissions (ACL) on the target.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D101F4Other-2016345612
Syncml(500)
OMA-DM status 500: the device encountered an unexpected condition that prevented it fulfilling the request.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D1FDE8Other-2016281112
Remediation failed (-2016281112)
Intune could not confirm the setting was applied, because the device response did not match the policy. Seen for example with custom OMA-URI VPN profiles even when the VPN works.
Check: For custom VPN profiles it can be ignored, or use a standard VPN profile instead of OMA-URI. For other settings, check the value applied on the device.
Microsoft source ↗
0x87D1FDE9Other-2016281111
Not applicable for this device
The policy or setting does not apply to this device.
Check: Check the setting is supported on the device's platform, edition and OS version.
Microsoft source ↗
0x87D1FDEBOther-2016281109
Data type conversion failed
The setting value could not be converted to the expected data type.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗
0x87D1FDEEOther-2016281106
Not applicable because it lost in conflict resolution
The setting was not applied because another policy setting won conflict resolution.
Check: Find the conflicting policies targeting the device and remove or align the duplicate setting.
Microsoft source ↗
0x87D1FDEFOther-2016281105
Failed to evaluate the Rule
Intune failed to evaluate a rule for the setting.
Check: Check the setting's OMA-URI, value and data type against the relevant CSP documentation, and review the DeviceManagement-Enterprise-Diagnostics-Provider Admin event log on the device.
Microsoft source ↗

Every entry comes from Microsoft's documentation and links to its source. Decimal values are the signed 32-bit form of the hex code. For Win32 app return codes, see the Win32 app command builder.