'DeviceAADJoin' failed with '0x8018000A' or APP with 4fdb6e89-84e8-4e85-a606-176df7a8737b remove device

Mountain Pond 881 Reputation points
2023-05-16T21:05:35.7833333+00:00

Hello,

I'm using provision package for migration from on-prem to Azure AD. Everything was fine, but from some point, some devices join Azre AD, while others do not want to. At the same time, my test machine on Hyper-V may or may not be connected (I restore from a checkpoint and repeat the process). Each time there may be different results.

I looked at the event log and saw an error

ProvXML category 'DeviceAADJoin' failed with '0x8018000A' at CSP node 'AADJ/BPRT'

ApplicationFrameHost_zRFNe0Gjm8

In the audit log, I see that the device joins and after a while the application removes it.

msedge_1sBdejyfFG

I didn't find what app it is. I can't find it by ID. I suspect that I have increased the number of devices allowed.

msedge_6c7vN5IWny

Therefore, this limit was magnified, it seems that you need to wait a while.

Also, I have long excluded the account from being authenticated without a second factor. This is not a problem.

I can't find any information what this app is and why it deletes new devices.

Thank you.

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
14,663 questions
Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
973 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla (MSFT) 18,496 Reputation points Microsoft Employee
    2023-05-17T06:59:57.4633333+00:00

    Hello @Denis Pasternak , app with appId 4fdb6e89-84e8-4e85-a606-176df7a8737b does not look like Microsoft first party app. Try finding its service principal using PowerShell:

    Connect-AzureAD
Get-AzureADServicePrincipal -Filter "appId eq '4fdb6e89-84e8-4e85-a606-176df7a8737b'"

    If you cannot then will need to to create an Azure Support Request ensuring Advanced diagnostic collection is enabled and request it to be assigned to Alfredo Revilla, that's me :)

    Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.