Cannot enroll MS365 licenced users into intune when logging into Entra Hybrid joined windows device

Question

Hi, so I created a GPO that "should" automatically join devices as Entra Hybrid Joined and enroll licnesed users into intune.

The devices do become EAAHJ but when i log into the W10 computer as a MS365 Business Premium licenced user they don't enroll into intune.

i tried a newly wiped laptop in case this particular computer was the issue, but had the same deal, it becomes EAADHJ but wont enroll any licences user into intune (tried multiple users).

Checking Event Viewer i get the following:

Error: 0xCAA5001C Token broker operation failed.

Operation name: GetTokenSilently, Error: -895352830 (0xcaa20002), Description: AADSTS65002: Consent between first party application 'e9c51622-460d-4d3d-952d-966a5b1da34c' and first party resource 'f2d19332-a09d-48c8-a53b-c49ae5502dfc' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID: b13a24c6-fa0f-41bd-9e0b-d406bec80d00 Correlation ID: 00bd23b9-ef5f-40a9-ab5a-ad580c07f21b Timestamp: 2024-08-06 08:26:39Z

Logged at WebAccountProcessor.cpp, line: 671, method: AAD::Core::WebAccountProcessor::ReportOperationError.

I also get a "warning:

Error: 0xCAA90056 Renew token by the primary refresh token failed.

Logged at RefreshTokenRequest.cpp, line: 147, method: RefreshTokenRequest::AcquireToken.

Request: authority: https://login.microsoftonline.com/common, client: e9c51622-460d-4d3d-952d-966a5b1da34c, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/e9c51622-460d-4d3d-952d-966a5b1da34c, resource: f2d19332-a09d-48c8-a53b-c49ae5502dfc, correlation ID (request): 00bd23b9-ef5f-40a9-ab5a-ad580c07f21b

dsregcmd /status reveals no token, dsregtools claims everything is healthy except the PRT, but i'm going around in circles trying to resolve this.

So it seems there is no issue with the device, just the token to allow licenced users to enroll into intune.

EAD shows the device as EAADHJ but with no primary user logged into it.

Desperate for help please.

Answer 1

Hello

It sounds like you're encountering issues with Azure Active Directory (AAD) Hybrid Join and Intune enrollment after setting up your Group Policy Object (GPO). The error messages you're seeing in the Event Viewer are often indicative of token issues or permission/consent issues with the applications involved. Here’s a structured approach to troubleshoot and resolve the problems:

1. Verify Group Policy Configuration:

   Make sure that your GPO settings for automatic enrollment and hybrid join are configured correctly. Check for the following settings:

• Automatic Enrollment: Ensure that "Automatic Enrollment in Intune" is enabled in the GPO under Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> MDM.
• Hybrid Azure AD Join: Ensure that the settings under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies -> Automatic Certificate Request Settings, are correctly configured to allow hybrid join.

2. Check Azure AD Credentials:

   Double-check that the user accounts you're using to log in to the devices are licensed for Intune and are part of AAD. Ensure that the users are also part of the relevant security groups if you have any role-based access control (RBAC) implemented.

3. Review Token Configuration:

   The error you’re encountering indicates a token broker issue:

• Make sure that the users are consented properly to enroll devices in Intune.
• Check if there’s any conditional access policy or restrictions that may be preventing the users from obtaining tokens.
• Ensure that the required permissions are granted for the applications linked to the Intune registration.

4. Verify Conditional Access Policies:

   If you have any Conditional Access policies configured in Azure AD, ensure they permit device registration and enrollment. You may have policies that are blocking or restricting access based on device status, location, or other factors.

5. Check Licensing:

   Confirm that the users logging in indeed have a valid Microsoft 365 Business Premium license. Go to the Azure AD portal, and under the Users section, check the licenses assigned to each user.

6. Check for Multifactor Authentication (MFA):

   If MFA is enabled, ensure that it is working properly. Sometimes, users need to complete MFA before they can get the necessary tokens for Intune.

7. Manually Trigger Intune Enrollment:

   After logging into the device with the proper user, try manually triggering the Intune enrollment:

• Open Settings -> Accounts -> Access work or school.
• Click the connected account and go to Info.
• Click Sync to force the sync process.

8. Utilize Logs for Deeper Diagnosis:

   You have already checked logs; capturing logs from the Intune management extension and Event Viewer can provide more insights:

• Look under the Applications and Services Logs -> Microsoft -> Windows -> DeviceManagement-Enterprise-Diagnostics-Provider for detailed logs.
• Consider using the Health Attestation service or Azure AD Diagnostics to gather more insight.It sounds like you're encountering issues with Azure Active Directory (AAD) Hybrid Join and Intune enrollment after setting up your Group Policy Object (GPO). The error messages you're seeing in the Event Viewer are often indicative of token issues or permission/consent issues with the applications involved. Here’s a structured approach to troubleshoot and resolve the problems:
  1. Verify Group Policy Configuration:
     Make sure that your GPO settings for automatic enrollment and hybrid join are configured correctly. Check for the following settings:
  • Automatic Enrollment: Ensure that "Automatic Enrollment in Intune" is enabled in the GPO under Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> MDM.
  • Hybrid Azure AD Join: Ensure that the settings under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies -> Automatic Certificate Request Settings, are correctly configured to allow hybrid join.
  2. Check Azure AD Credentials:
     Double-check that the user accounts you're using to log in to the devices are licensed for Intune and are part of AAD. Ensure that the users are also part of the relevant security groups if you have any role-based access control (RBAC) implemented.
  3. Review Token Configuration:
     The error you’re encountering indicates a token broker issue:
  • Make sure that the users are consented properly to enroll devices in Intune.
  • Check if there’s any conditional access policy or restrictions that may be preventing the users from obtaining tokens.
  • Ensure that the required permissions are granted for the applications linked to the Intune registration.
  4. Verify Conditional Access Policies:
     If you have any Conditional Access policies configured in Azure AD, ensure they permit device registration and enrollment. You may have policies that are blocking or restricting access based on device status, location, or other factors.
  5. Check Licensing:
     Confirm that the users logging in indeed have a valid Microsoft 365 Business Premium license. Go to the Azure AD portal, and under the Users section, check the licenses assigned to each user.
  6. Check for Multifactor Authentication (MFA):
     If MFA is enabled, ensure that it is working properly. Sometimes, users need to complete MFA before they can get the necessary tokens for Intune.
  7. Manually Trigger Intune Enrollment:
     After logging into the device with the proper user, try manually triggering the Intune enrollment:
  • Open Settings -> Accounts -> Access work or school.
  • Click the connected account and go to Info.
  • Click Sync to force the sync process.
  8. Utilize Logs for Deeper Diagnosis:
     You have already checked logs; capturing logs from the Intune management extension and Event Viewer can provide more insights:
  • Look under the Applications and Services Logs -> Microsoft -> Windows -> DeviceManagement-Enterprise-Diagnostics-Provider for detailed logs.
  • Consider using the Health Attestation service or Azure AD Diagnostics to gather more insight.