Share via

Intune MDM authority is not configured ( we want to know what settings we need to configure) Automatic MDM enrollment is not enabled ( its enabled but not working as we are expecting) User is not in the MDM enrollment scope ( User is in enrollment scope)

Mohd Siddiqui 0 Reputation points
2026-06-09T13:42:29.25+00:00

C:\Users\t1-kmadavaram>dsregcmd /status

 

+----------------------------------------------------------------------+

| Device State                                                         |

+----------------------------------------------------------------------+

 

             AzureAdJoined : YES

          EnterpriseJoined : NO

              DomainJoined : YES

                DomainName : LENNAR

           Virtual Desktop : YES

               Device Name : len-win11pwcixB.Lennar.LennarCorp.com

 

+----------------------------------------------------------------------+

| Device Details                                                       |

+----------------------------------------------------------------------+

 

                  DeviceId : aa4179db-99cd-4536-b6fa-40bbedb54724

                Thumbprint : 8B96FD9C59CB48FD70EC854A88E7FA4A7DF8315D

DeviceCertificateValidity : [ 2026-05-26 08:58:02.000 UTC -- 2036-05-26 09:28:02.000 UTC ]

            KeyContainerId : 5789c31a-7920-438b-94f2-30a086d41a58

               KeyProvider : Microsoft Software Key Storage Provider

              TpmProtected : NO

          DeviceAuthStatus : SUCCESS

 

+----------------------------------------------------------------------+

| Tenant Details                                                       |

+----------------------------------------------------------------------+

 

                TenantName :

                  TenantId : 28e546c7-fd4b-4246-b0c1-c800d6381d7d

               AuthCodeUrl : https://login.microsoftonline.com/28e546c7-fd4b-4246-b0c1-c800d6381d7d/oauth2/authorize

            AccessTokenUrl : https://login.microsoftonline.com/28e546c7-fd4b-4246-b0c1-c800d6381d7d/oauth2/token

                    MdmUrl :

                 MdmTouUrl :

          MdmComplianceUrl :

               SettingsUrl :

            JoinSrvVersion : 2.0

                JoinSrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/device/

                 JoinSrvId : urn:ms-drs:enterpriseregistration.windows.net

             KeySrvVersion : 1.0

                 KeySrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/key/

                  KeySrvId : urn:ms-drs:enterpriseregistration.windows.net

        WebAuthNSrvVersion : 1.0

            WebAuthNSrvUrl : https://enterpriseregistration.windows.net/webauthn/28e546c7-fd4b-4246-b0c1-c800d6381d7d/

             WebAuthNSrvId : urn:ms-drs:enterpriseregistration.windows.net

    DeviceManagementSrvVer : 1.0

    DeviceManagementSrvUrl : https://enterpriseregistration.windows.net/manage/28e546c7-fd4b-4246-b0c1-c800d6381d7d/

     DeviceManagementSrvId : urn:ms-drs:enterpriseregistration.windows.net

 

+----------------------------------------------------------------------+

| User State                                                           |

+----------------------------------------------------------------------+

 

                    NgcSet : NO

           WorkplaceJoined : NO

             WamDefaultSet : NO

 

+----------------------------------------------------------------------+

| SSO State                                                            |

+----------------------------------------------------------------------+

 

                AzureAdPrt : NO

       AzureAdPrtAuthority :

     AcquirePrtDiagnostics : PRESENT

      Previous Prt Attempt : 2026-06-08 11:30:37.487 UTC

            Attempt Status : 0xc000006d

             User Identity : ******@Lennar.LennarCorp.com

           Credential Type : Password

            Correlation ID : 25ca8591-f945-46d3-81d6-996d1a8e41b5

              Endpoint URI : https://login.microsoftonline.com/28e546c7-fd4b-4246-b0c1-c800d6381d7d/oauth2/token

               HTTP Method : POST

                HTTP Error : 0x0

               HTTP status : 400

         Server Error Code : invalid_grant

  Server Error Description : AADSTS50034: The user account {EUII Hidden} does not exist in the 28e546c7-fd4b-4246-b0c1-c800d6381d7d directory. To sign into this application, the account must be added to the directory. Trace ID: 786d7f78-38a6-4dae-8095-08febd540200 Correlation ID: 25ca8591-f945-46d3-81d6-996d1a8e41b5 Timestamp: 2026-06-08 11:30:38Z

             EnterprisePrt : NO

    EnterprisePrtAuthority :

 

+----------------------------------------------------------------------+

| Diagnostic Data                                                      |

+----------------------------------------------------------------------+

 

        AadRecoveryEnabled : NO

    Executing Account Name : LENNAR\t1-kmadavaram, ******@Lennar.LennarCorp.com

               KeySignTest : PASSED

 

        DisplayNameUpdated : YES

          OsVersionUpdated : YES

           HostNameUpdated : YES

 

      Last HostName Update : NONE

 

+----------------------------------------------------------------------+

| IE Proxy Config for Current User                                     |

+----------------------------------------------------------------------+

 

      Auto Detect Settings : YES

    Auto-Configuration URL :

         Proxy Server List :

         Proxy Bypass List :

 

+----------------------------------------------------------------------+

| WinHttp Default Proxy Config                                         |

+----------------------------------------------------------------------+

 

               Access Type : DIRECT

 

+----------------------------------------------------------------------+

| Ngc Prerequisite Check                                               |

+----------------------------------------------------------------------+

 

            IsDeviceJoined : YES

             IsUserAzureAD : NO

             PolicyEnabled : YES

          PostLogonEnabled : NO

            DeviceEligible : NO

        SessionIsNotRemote : NO

            CertEnrollment : none

              PreReqResult : WillNotProvision

 

+----------------------------------------------------------------------+

| Virtual Desktop Settings                                             |

+----------------------------------------------------------------------+

 

                  Provider : Citrix

                      Type : 2 (Persistent)

                 User mode : 1 (Single-user)

                Extensions : 0

 

For more information, please visit https://www.microsoft.com/aadjerrors

C:\Users\t1-kmadavaram>

Microsoft Security | Intune | Enrollment

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-09T13:42:59.9566667+00:00

    The dsregcmd output shows the device is correctly Microsoft Entra hybrid joined (AzureAdJoined = YES, DomainJoined = YES), but MDM auto-enrollment and user SSO are failing because:

    1. MDM URLs are empty
      • In the Tenant Details section, these values are blank:
        • MdmUrl
        • MdmTouUrl
        • MdmComplianceUrl
        • SettingsUrl
      • When auto-enrollment is correctly configured, these URLs are populated from Microsoft Entra ID based on the MDM authority and auto-enrollment settings.
    2. The user account used for SSO does not exist in the tenant
      • SSO State shows:
        • AzureAdPrt : NO
        • HTTP status : 400
        • Server Error Code : invalid_grant
        • Server Error Description: AADSTS50034: The user account … does not exist in the 28e546c7-fd4b-4246-b0c1-c800d6381d7d directory.
      • This means the sign-in attempt is using an identity that is not present in the Microsoft Entra tenant, so a Primary Refresh Token (PRT) cannot be issued. Without a valid user in the tenant and PRT, user-based auto-enrollment cannot complete.

    To get auto-enrollment working as expected, the following must be in place:

    1. Verify MDM authority and auto-enrollment configuration
      • Ensure the tenant’s MDM authority is set to Intune and that automatic MDM enrollment is configured for the correct users/groups.
      • The MDM authority and auto-enrollment settings must be configured in Microsoft Entra ID/Intune so that:
        • The device is allowed to auto-enroll into Intune.
        • The MDM URLs (MdmUrl, MdmComplianceUrl, SettingsUrl) are published to the device.
      • The article on diagnosing MDM enrollment explicitly calls out:
        • The user must have a valid Intune license.
        • Auto-enrollment must be activated for those users.
        • The device OS must be a supported Windows version.
        • Auto-enrollment via Group Policy is valid only for Microsoft Entra hybrid joined devices, which is already true in this case.
    2. Confirm the user account is in the correct tenant and licensed
      • The error AADSTS50034 indicates the UPN being used does not exist in the tenant with ID 28e546c7-fd4b-4246-b0c1-c800d6381d7d.
      • Ensure:
        • The user’s UPN matches an account synchronized or created in this tenant.
        • The user has an Intune license assigned.
        • The user is in the MDM user scope configured for automatic enrollment.
    3. Validate hybrid join and SSO prerequisites
      • For auto-enrollment via Group Policy, the device must be Microsoft Entra hybrid joined and have a valid PRT:
        • dsregcmd /status should show:
          • AzureAdJoined : YES
          • DomainJoined : YES
          • AzureAdPrt : YES
      • The diagnostics guidance notes that auto-enrollment requires:
        • Hybrid join (already present).
        • A valid Microsoft Entra PRT (currently missing because the user is not recognized in the tenant).
    4. Re-run dsregcmd diagnostics after fixing tenant/user configuration
      • After ensuring:
        • MDM authority is Intune.
        • Auto-enrollment is enabled for the user.
        • The user exists in the tenant and is licensed.
      • Sign in with that user, then run dsregcmd /status again to confirm:
        • MdmUrl and related URLs are populated.
        • AzureAdPrt is YES.
        • Auto-enrollment should then proceed and the device should enroll into Intune.

    If MDM URLs remain blank after confirming the above, verify the auto-enrollment configuration and Group Policy (if used) against the “Verify autoenrollment requirements and settings” guidance.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.