Joining device to Microsoft Entra suddenly fails

Question

Hello,

Problem: When I'm trying to join a Windows 10/11 device to Microsoft Entra to enable M365 login on the device, an error will be displayed: Something went wrong. “We can’t connect to the URL for your organization’s MDM terms of use” ... Error: unauthorized_client - Description: unauthorized_user_or_tenant.

Previously this has been used without any trouble and a couple of our devices still use Entra login, which have been configured earlier to use it.

Also another problem: If a user is using Office 365 desktop application on any device (domain or not) and is going to log in, after entering the password and allowing the organization to manage the device, an error will be shown: CAA50024, signing in was somehow not possible.. Error response came from MDM terms of use page.

We don't use Intune and I have set at MS Entra Admin Centre at Microsoft.Intune MDM User scope as None and WIP User scope also as None, and I also have restored the default MDM URLs.

Background: For a short time before the trouble, we had Samsung Knox connected to Entra with the attention to sync users only instead of a direct connection to our AD. By a mistake this Entra configuration was made and it was also adding Windows devices to Samsung Knox MDM system. The connection was removed and also at Entra the Samsung Knox Manage application was removed. But this has probably left some of its own configurations behind or has not been restored the original settings of Entra. At the time this connection existed, users were also shown a page of terms of use by Samsung with a black background, if they signed in at an O365 application. Now the page is not anymore displayed, but there is as short black blink before the error pages is displayed, so probably some URL has been left behind.

But I cannot find any setting at Entra, which would have something to do with Samsung or any other MDM system, that would be differently than advised. Maybe the real problem really is, that the MDM terms of use page can't be found. But how can I fix this?

Our only goal is to set up and enable the Entra login on computers, which are used outside of our domain network. There is no Intune setup at this point active.

Answer 1

Thank you very much for these advises. These were already tried, but I now got a solution from Samsung, which was:

Access Entra ID Portal > Click 'Mobility (MDM and WIP)' from left menu > Click 'Samsung Knox Manage'
 
After access the Samsung Knox Manage app detail,

1. Select 'None' for user scope
2. Click 'Delete'

So what I actually had to do, because Samsung Knox Manage was already removed, I installed it again at MDM & WIP, changed the scope from 'Some' to 'None' and deleted it again. This seems to have done the trick.

Answer 2

Hi Isto,

Thank you for posting in Microsoft Community.

I understand you're facing a challenging situation: Windows 10/11 devices are failing to join Microsoft Entra ID, and Office 365 apps are showing MDM-related errors (like "We can’t connect to the URL for your organization’s MDM terms of use" and CAA50024).

It's highly likely that even after removing Samsung Knox MDM, some of its configurations remain in your Microsoft Entra ID tenant. This causes Entra ID to still attempt a redirect to a Samsung Knox terms of use page that no longer exists, leading to these errors.

Since your goal is to enable Entra login without using Intune or any other MDM, let's systematically check your Microsoft Entra Admin Center for these lingering settings.

Troubleshooting Steps in Microsoft Entra Admin Center:

Start by navigating to the Microsoft Entra admin center (entra.microsoft.com).

1. Mobility (MDM and MAM) - The Most Likely Culprit

This is where all MDM services connected to your Entra ID tenant are managed.

• In the left menu, go to Identity > Devices > All devices.
• In the top bar, click "Device settings".
• Scroll down to "Mobility (MDM and MAM)".
• Examine ALL listed applications here. Even if "Microsoft Intune" is set to "None", look for any other entries that might be related to Samsung Knox (e.g., "Samsung Knox Mobile Enrollment").
  • For each listed application:
    • Click its name.
    • Verify the "MDM User scope" and "MAM User scope". Ensure both are set to "None" if you want no MDM auto-enrollment.
    • Crucially, check the "MDM terms of use URL", "MDM Discovery URL", and "MAM Terms of Use URL" fields.
      • If you see any URLs specific to Samsung Knox, try to clear them or restore them to blank/default values (which would typically be Intune defaults if Intune is present).
      • Sometimes, simply toggling an application's scope (e.g., set to "Some," save, then set back to "None," save) can help refresh its configuration.

2. Device Settings Overview

Still under Identity > Devices > All devices > "Device settings":

• Ensure "Users may join devices to Microsoft Entra ID" is set to "All" or a group that includes your users. This is essential for Entra Join itself.
• Review other settings like "Maximum number of devices per user" if your users are hitting device limits.

3. Enterprise Applications

Residual app registrations from Samsung Knox might still exist.

• In the left menu, go to Identity > Applications > Enterprise applications.
• In the search bar, look for any applications related to "Samsung Knox" or "MDM".
• If found, check their properties. Ensure they don't have any permissions that could interfere with device management.

4. Conditional Access Policies

Policies here might be inadvertently blocking device join if no MDM is present.

• In the left menu, go to Identity > Protection > Conditional Access.
• Review your existing Conditional Access policies. Look for any that:
  • Require devices to be "compliant" or "Hybrid Azure AD joined" without an MDM solution.
  • If such a policy exists, it would explain why users are blocked. You may need to temporarily disable or modify it for your test users.

5. Audit Logs

Reviewing logs can help pinpoint when specific MDM configurations were added or removed.

• In the left menu, go to Identity > Monitoring & health > Audit logs.
• Filter by "Activity" (e.g., "Update MDM application," "Set device settings") and the "Date" range around when you connected and removed Samsung Knox. This can show you the exact changes made to your MDM configuration.

For the Office 365 Desktop Client Error (CAA50024):

Since the CAA50024 error specifically occurs with Office 365 desktop applications and points to the MDM terms of use page, this also strongly indicates the residual MDM configuration. However, it's also a good idea to perform a quick repair on the Office installation itself.

• Quick Repair Office Applications:
  • Close all Office applications.
  • Go to Windows Settings > Apps > Apps & features.
  • Find your Microsoft Office installation (or Microsoft 365 Apps for enterprise).
  • Click on it, then select "Modify" (or "Change").
  • Choose "Quick Repair" first. If that doesn't resolve it, you can try "Online Repair" (which is more thorough but takes longer).
  • For your reference: Repair an Office application.

For references:

Microsoft Entra integration with MDM | Microsoft Learn

How to register an app in Microsoft Entra ID - Microsoft identity platform | Microsoft Learn 

Troubleshoot Microsoft Entra hybrid joined devices - Microsoft Entra ID | Microsoft Learn

If none of the above solutions work, let me know for further investigation. Please note that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.
Kind regards,

Kai-L - MSFT | Microsoft Community Support Specialist