This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 51%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
We have 3 users (out of 200+) having this error on their workstations when enrolling their Windows 10 workstations in Intune:
This happens after they launch the Company Portal and login with our organization's Microsoft account and they click "Yes" on this screen:
The device shows up for the briefest of moments in the Intune Admin portal, but goes away once they click "Done" on the error. Doesn't show up as an enrollment error in the portal.
Details on our environment and the workstations:
OS: Windows 10 1903 (latest updates installed as part of the troubleshooting direct from Microsoft, no WSUS server)
AD: All workstations are added to an on-prem domain that is not connected to Azure AD, no AD-Connect setup done or planned (I can elaborate on why if needed or relevant to the error).
No SCCM in our environment.
Enrollment method: Local install of the Company Portal app from the Microsoft Store
End users are local administrators on their workstations.
I apologize in advance if I left something out, first time posting on here. I will add it as a reply/edit, whatever this forum allows. Thanks!
That error code means file not found. Not sure exactly what that means in this context though.
Have you reviewed User Device Registration event log or run dsregcmd /status as described at https://learn.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current?
I am not attempting a hybrid join, but this might uncover some additional info that might help. I will get a hold of a user and run dsregcmd /status and review the User Device Registration even logs. Thanks!
Right, but the error shown above is specific to the Azure AD status of the system which is part of the process when enrolling into Intune.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(249.60000000000002, 84%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
Please make sure the account is either an Intune service administrator, or a tenant administrator with the global administration permission, meanwhile, the account should have been assigned an Intune license.
Here are the links of Intune licensing and how to assign license:
https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses
https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses-assign
Please make sure the account is either an Intune service administrator, or a tenant administrator with the global administration permission
Why? This is not required to enroll a device in Intune.
The users in question are licensed with either an M365 E3 or an EMS E3, both of which include Intune. I even tried swapping licenses to see if that changed anything. And I agree with Jason, the end users do not need to have any elevated Azure or Intune level permissions to enroll their devices. All other users have been able to enroll. I expect this to be a workstation or user specific issue
Why would the account be an intune or tenant admin this scenario is when you are most likely to be enrolling as an end user
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 68%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
I have the same exact error, did you manage to fix it ?
No, Microsoft support said a hybrid join via GPO might work (not an option in our environment, since not every workstation is on-prem domain joined), and that otherwise, the workstation would have to have a fresh install of Win 10, which is the route we went.