Intune Enrollment issues

Edgar Serrano 6 Reputation points
2021-08-24T18:03:18.66+00:00

I am stuck on the Intune enrollment process. The computers in the domain are all AAD, however, when the GPO that i created to enroll AAD devices into Intune runs, it fails with the multiple errors:
Event ID: 71 - MDM Enroll: Failed
Event ID: 76 - Auto MDM Enroll: Device Credentials (0x0) Failed
Event ID: 11 - MDM Enrollment: Failed to receive or parse cert enroll response.
Event ID: 52 - MDM Enroll: Server returned Fault/code/subcode/value=(messageformat) fault/reason/text=(device based token is not supported for enrollment type onpremisegrouppolicycomanaged).
Event ID: 59 - MDM Enroll: server context

The one thing that is different about this environment, is that their local domain is: CompanyA.local and their tenant domain is Company123.com. Under the local domain, i made sure that the new UPN for the tenant was there. But that did not make a difference when i manually resync'd the process. This is a hybrid environment with an AD connect server.

As for the GPO, i have set it from Device to Client to see if it makes a difference - and nothing.
By the way, this new GPO object has an application id. Not sure what that is, so i left it blank.

When i run a dsregcmd /status - AzureAD joined is YES and so is DomainJoined. What is a bit strange, is that under Tenant Details, the mdmurl section is blank.

I have pretty much done everything that i can find on this forum and elsewhere but i cannot get the devices to enroll successfully into Intune/Endpoint manager.

Thanks in advance.

Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
1,254 questions

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Sandys 31,161 Reputation points Microsoft Employee
    2021-08-24T18:15:30+00:00

    The computers in the domain are all AAD

    This is not possible. A system can only be joined to a single domain whether that's an on-prem AD or an AAD domain doesn't matter. There is the cioncpet of hybrid Azure AD join (HAADJ) which is an on-prem AD join + an AAD registration at a device level.

    When i run a dsregcmd /status - AzureAD joined is YES and so is DomainJoined.

    This is an HAADJ device.

    when the GPO that i created to enroll AAD devices into Intune runs

    Based on the log, you've configured the GPO to use device credentials but that's not supported for anything except use by Co-management in ConfigMgr to my knowledge. You need to use User Credentials.

    1 person found this answer helpful.
  2. FENG CHEN 16 Reputation points
    2021-12-14T13:42:00.133+00:00

    I got the exact same problem yesterday. All three MDM urls were empty. I found https://twitter.com/richardhicks/status/1212104113002934272?lang=en and it somehow worked for him later. https://www.anoopcnair.com/intune-enrollment-error-unknown-win32-error/ mentioned need to wait a bit.

    I finally gave up yesterday. This morning when I checked it again, I noticed those URLs are filled:

    157512-image.png

    I checked event log and see it got enrolled after 3~4 hours:

    157522-image.png

    So I guess it does take time.

    1 person found this answer helpful.
    0 comments
  3. Nick Hogarth 3,436 Reputation points
    2021-08-24T18:21:25.833+00:00

    It should still work with device credential in the GPO. Have you confirmed that the synced users have an Intune license and an Azure AD Premium license? Is Autoenrollment set up in in Intune?

  4. Andrejus 1 Reputation point
    2021-11-02T22:54:24.267+00:00

    Hey, did you manage to resolve your issue? Im experiencing exactly the same problem and my scenario is identical to yours.
    Thanks in advance

    0 comments
  5. Edgar Serrano 1 Reputation point
    2021-11-02T23:05:58.253+00:00

    The issue in my case is a bit. Yes it ended up working correctly in Lab. What ended u being the problem was MFA. The user we were testing with had MFA enabled, we disabled it and then EVERYTHING started to work.

    Now that i am applying it to the entire company it's now not working. I attached the GPO to the correct OU but i am still checking logs....

    I really wished that Microsoft made a product that did not give out so many issues.