Cannot enroll new devices to InTune. Error code: CAAC000E

Question

Cannot enroll new devices to InTune. Error code: CAAC000E

Jim 306

Small company. 365 small business. About 40-50 users. Local AD Domain

I'm the admin for the tenant. I am starting to try and leverage Azure for supporting the machines. The machines are all registered under devices in Entra. This seems to occur automatically after I install the Office applications on the laptop.

I just started to look into InTune to evaluate it's value for us. When I went there the only machine registered under devices was a VM I created for testing. None of the laptops I have built that are in Entra were listed in InTune.

So I was setting up a new laptop and went to "Set up a work or school account" put in my 365 credentials and it showed up in InTune. Thinking I was on to something here I took another laptop and did the same thing. Got this:

User's image

I subsequently found the "Enrollments" area where it said I could have 5 enrollments. I upped it to 15, no change. Time and date are configured per instructions I found elsewhere.

Anyway, Here is what I want, if possible:

A way to bulk add the current machines to InTune.
A way to have unlimited enrollments going forward as I set up all the Laptops.

Thanks for any help.

1 answer

Your answer

Answer 1

Crystal-MSFT 52,996 Microsoft External Staff

@Jim, Thanks for posting in Q&A. To ensure device into Intune, we need to ensure the user is with Microsoft Intune Plan 1 license assigned. And one license can enroll up to 15 devices per user.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses#microsoft-intune-plan-1

Meanwhile, I notice you have the local AD domain. If you want these devices joined to your on-premises Active Directory and registered with Microsoft Entra ID. I think you need to consider Microsoft Entra hybrid joined.

https://learn.microsoft.com/en-us/entra/identity/devices/concept-hybrid-join

And for such devices to enroll into Intune, the common enrollment method we choose is GPO enrollment. And this is for the device which is used by one user.

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

For shared device, you can consider DEM with device license or Autopilot self deploying with device license.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-06T02:20:09.95+00:00

@Jim, Hope the above information can help. If there's anything unclear, feel free to let us know.
Jim 306 Reputation points

2024-08-06T17:35:20.24+00:00

This just gets more and more confusing. See my notations below:

@Jim, Thanks for posting in Q&A. To ensure device into Intune, we need to ensure the user is with Microsoft Intune Plan 1 license assigned. And one license can enroll up to 15 devices per user.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses#microsoft-intune-plan-1

OK, but how do I find out what licenses we have? I see nothing for InTune in my3 65 admin center under licenses.

Meanwhile, I notice you have the local AD domain. If you want these devices joined to your on-premises Active Directory and registered with Microsoft Entra ID. I think you need to consider Microsoft Entra hybrid joined.

https://learn.microsoft.com/en-us/entra/identity/devices/concept-hybrid-join

I do in fact see all my AD joined computers in Entra already. I have no idea how they got there other then they all have 365 Office install on them. They seem to show up after Office gets installed.

And for such devices to enroll into Intune, the common enrollment method we choose is GPO enrollment. And this is for the device which is used by one user.

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

I'll look into this but I was hoping there was a better/easier way due to the fact they already exist in Entra. I was hoping I could just do a select all in Entra and the add them to InTune. Looks like that was a pipe dream...

For shared device, you can consider DEM with device license or Autopilot self deploying with device license.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows

This brings up another point. I want to just have myself and another admin get these devices added to InTune. Would that mean we each have multiple devices and this is what is stopping us?

Hope the above information c
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-07T02:12:13.41+00:00

@Jim, Thanks for the reply. For your question, here are my answers:

Q1: but how do I find out what licenses we have? I see nothing for InTune in my3 65 admin center under licenses.

A1: You can login Intune portal and find the user you used to enroll the device, click "Licenses" to see if it has any license which included Microsoft Intune Plan 1 included.

Q2: I do in fact see all my AD joined computers in Entra already. I have no idea how they got there other then they all have 365 Office install on them. They seem to show up after Office gets installed.

A2: It can be that you select "Allow may organization to manage the device" option when you login office. This will register device into Mcirosoft Entra.

Q3: I'll look into this but I was hoping there was a better/easier way due to the fact they already exist in Entra. I was hoping I could just do a select all in Entra and the add them to Intune. Looks like that was a pipe dream...

A3: The only method I can think is let the device owner with Microsoft Intune license to click Settings-> Account-> Access Works or School, click Connect again to enter the same account as the device owner in Microsoft Entra. But this is not recommended. The device will be considered as personal device not a company device and you can only assign policy or app to device group. If you want to assign to user group like conditional access policy and etc, it cannot work on these devices. The recommended method for such devices is still GPO enrollment.

Q4: This brings up another point. I want to just have myself and another admin get these devices added to InTune. Would that mean we each have multiple devices and this is what is stopping us?

A4: If you use your own account to enroll, then yes, that means the devices are owned by yourself. And it is not recommended. GPO enrollment is automatically and the user with both Microsoft Intune and Microsoft Entra premium licenses assigned will enroll automatically using their own account.

Hope the above information can help.
Jim 306 Reputation points

2024-08-08T16:51:09.4566667+00:00

@Crystal-MSFT Wow! amazingly great answers! "Crystal clear";+}

That being said I don't find any InTune licenses listed anywhere and I wonder if we simply don't have the right 365 licenses to do this. This is what we have:

So am I simply not able to do this unless we have a more advanced 365 license?

As for your A2 above, yes, I always take that option.

As for A4, can you expand a bit, or point me to a document that explains how I use an onsite domain GPO (I don't know if there are Azure GPO's) to do this? Assuming of course my licensing above will even permit that.
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-09T02:16:11.3933333+00:00

@Jim, Thanks for the reply. Yes, you need a more advanced Microsoft 365 license which include Intune. For the GPO, it is configured in on-premise AD environment. You can create domain group policy on domain controller. Not Azure. Could you double confirm if you have on-premise AD?
Jim 306 Reputation points

2024-08-09T12:18:56.52+00:00

@Crystal-MSFT Yes, we have on-prem AD. So we have a mix of licenses. We do have 25 E3 licenses. Does this mean we can add 25 machines to InTune? Or is it 25x15 per license. Or does it give us unlimited just because we have some E3? It is confusing....
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-12T01:46:19.3333333+00:00

@Jim, Thanks for the reply. If the license is Microsoft 365 E3 license, it is user license. You can assign to 25 users. Each user can enroll up to 15 devices into Intune. For these devices, they are owned by this user. So for the license amount, this depends on how many users. If there are 35 users in your environment, we need to purchase 35 licenses.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses-assign

Hope the above information can help.
Jim 306 Reputation points

2024-08-13T14:14:48.92+00:00

@Crystal-MSFT OK, so they would still be owned by the user. I don't think that is what we want. Bottom line we want the devices to be in InTune, but to only be accessed/controlled by the admins of our 365 domain, of which we have 2. If I understand you correctly a user, call him User1, with an E3 license would be able to add 15 of our machines to InTune, but then User1 controls those devices and could subsequently manipulate them. That wouldn't work. Our end game here would be to have all 40-50 laptops in InTune and only Admin1 or Admin2 could see and manipulate them.

Does that make sense? If there is a way to do this, the next question is what would the cost be?
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-14T01:33:27.8766667+00:00

@Jim, Thanks for the reply. In General, Intune administrator or Global administrator can manage Intune enrolled devices via Intune portal. For standard user, they don't have the permission to do it. For the user who enrolls the device, it means the device it owned by this user. When a policy is assigned to this user, then all the devices which is owned by this user will receive the policy.

For your situation, I think you need to buy each license for each user.

Hope the above information can help.
Jim 306 Reputation points

2024-08-14T12:01:01.1266667+00:00

@Crystal-MSFT I think I get it. What would the least expensive license be to get me what I want?
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-08-15T05:06:56+00:00

@Jim, Thanks for the reply. The basic license is Microsoft Intune Plan 1.

https://www.microsoft.com/en-us/security/business/microsoft-intune-pricing?msockid=1e0bddf9f234641717dbcc33f3b165cc

In most situations, customer not just buy this license. Like Microsoft Entra Premium license is also used. Or the Microsoft 365 may be used as well. You can contact our licensing support to give the most suitable license for you.

https://www.microsoft.com/en-us/Licensing

Share via

Cannot enroll new devices to InTune. Error code: CAAC000E

1 answer

Your answer