Use support tools and troubleshoot service-related issues
Even with meticulously designed policies and perfect role assignments, you inevitably encounter device sync failures, app deployment errors, or enrollment blocks. When an issue escalates beyond a simple configuration error, administrators must know how to effectively use Microsoft Intune’s built-in diagnostic tools and, if necessary, escalate the incident to Microsoft Support.
By following a structured troubleshooting methodology and gathering the right diagnostic data upfront, you can significantly reduce the time to resolution.
The initial troubleshooting checklist
Before diving into complex client-side logs or opening a ticket with Microsoft, run through this baseline checklist to eliminate the most common culprits:
- Check Service Health: Always verify that Microsoft isn't experiencing an active outage. Check Tenant administration > Tenant status and the Microsoft 365 Service Health dashboard.
- Verify Licensing and Group Membership: Ensure the affected user has an active Intune and Microsoft Entra ID Premium license assigned, and that they are actually in the Microsoft Entra ID group targeted by your failing policy.
- Use the Intune Troubleshooting Portal: Navigate to Troubleshooting + support > Troubleshoot. Select the affected user. This pane provides a consolidated view of their licensing, device compliance, assigned apps, and any recent enrollment failures.
- Check for Policy Conflicts: If a device is failing to apply a setting, check the Device configuration report. If another administrator deployed a conflicting setting to the same device (e.g., one policy forces a 4-digit PIN, another forces a 6-digit PIN), Intune will report a "Conflict" state and apply neither.
Common client-side tools and commands
If the Intune cloud console reports that everything should be working, but the device is still failing, you must investigate the endpoint itself.
Windows troubleshooting commands
For Windows devices, administrators and helpdesk staff rely heavily on native OS tools to diagnose MDM and identity issues.
- Check Microsoft Entra ID join state (
dsregcmd /status): Run this in a Command Prompt. It's the most critical command for diagnosing identity issues. Verify thatAzureAdJoinedorEnterpriseJoinedis set to YES. If the device has lost its trust relationship with Microsoft Entra ID, Intune policies fail to sync. - Force a manual MDM sync: Instead of waiting for the automated sync cycle, have the user go to Settings > Accounts > Access work or school, click their account, select Info, and click Sync.
- Review the Event Viewer: Windows logs MDM activity extensively. Open Event Viewer and navigate to
Applications and Services Logs>Microsoft>Windows>DeviceManagement-Enterprise-Diagnostics-Provider>Admin. Look for Error or Warning events that correlate with your deployment failures. - Collect MDM Diagnostics: You can pull a consolidated HTML report of all applied policies directly from the Windows endpoint by going to Settings > Accounts > Access work or school > Select your connected Account > Info and selecting Create report. Alternatively, you can trigger this remotely from the Intune admin center using the Collect diagnostics device action.
iOS/iPadOS/macOS and Android
For mobile platforms, the primary troubleshooting tool is the Company Portal app.
- Instruct the user to open the Company Portal app, shake their device (or navigate to the Settings menu), and select Send Logs. This sends the diagnostic data to Microsoft and generates an Incident ID that you can provide to support.
How to open a support request with Microsoft
When you have exhausted local troubleshooting and suspect a backend service issue or a bug, it is time to escalate.
Step 1: Open the Support Assistant
Microsoft Intune now provides an AI-powered Support Assistant as the primary entry point for help. It's designed as a self-service tool, not a gatekeeper — you can use it to find answers quickly, but you're never required to run diagnostics before opening a ticket.
You can access it from two places in the Intune admin center:
- Troubleshooting + support > Help and support
- The ? (help) icon available from any node in the admin center
Note
The Support Assistant is opt-in. You can choose to engage with it or skip directly to filing a ticket, and you can opt out at any time during the session.
The Support Assistant opens with three panes:
| Pane | What it does |
|---|---|
| Find solutions | Search the knowledge base, run targeted diagnostics, view tenant insights, and browse troubleshooting articles relevant to your issue. |
| Contact support | File a new support ticket when self-help doesn't resolve the issue. |
| Service requests | Review the history and status of your existing cases. |
Step 2: Try self-help first (optional)
In the Find solutions pane, describe your issue in natural language. The Support Assistant will suggest relevant articles, surface tenant-specific insights, and offer to run automated diagnostics that check common misconfigurations (policy assignments, connector health, licensing, etc.). This step is optional — use it when you want a fast answer or want to rule out known issues before engaging an engineer.
Step 3: File a support ticket
If self-help doesn't resolve the problem, switch to the Contact support pane:
- Describe the issue, including affected users, devices, error messages, and the time it started.
- Select your preferred contact method (email or callback).
- Choose a severity level — this drives response-time SLAs. If you have Premier or Unified Support, you unlock higher severity tiers, faster response targets, and the option to schedule a callback with a designated engineer at a specific time.
- Submit the request and track progress in the Service requests pane.
Tip
Customers on standard support plans are limited to lower severity levels and best-effort response times. If you operate business-critical workloads on Intune, Premier or Unified Support is worth evaluating for the SLA and named-contact benefits.