Why won't my Windows device enroll in Intune, and how do I fix the error code?

Key facts

• Windows automatic MDM enrollment requires an Intune subscription plus Microsoft Entra ID P1 or P2.
• MDM user scope has three options: None, Some or All. None disables automatic enrollment for every user.
• Error 0x80180014 ("Your organization does not support this version of Windows") means Windows (MDM) enrollment is blocked by a device platform restriction.
• An Intune device limit restriction can be set from 1 to 15 devices per user.
• Device limit restrictions do not apply to Entra join, Autopilot, Group Policy, co-management or device enrollment manager enrollments.
• MDM enrollment events are logged in Event Viewer under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.

Prerequisites and licensing

Before chasing an error code, confirm the tenant and the user are set up to enroll.

To change the automatic enrollment settings you need the Global Administrator role in Microsoft Entra ID. For PowerShell checks, install Microsoft Graph PowerShell with Install-Module Microsoft.Graph -Scope CurrentUser.

• Licenses: the tenant needs a Microsoft Intune subscription and Microsoft Entra ID P1 or P2. Each enrolling user needs an Intune license assigned.
• MDM user scope: must be All, or Some with the user in a selected group. If it is None, devices do not auto-enroll.
• WIP user scope: set to None, or make sure users are not in both the MDM and WIP scopes. On a personal device, WIP scope wins and the device does not enroll for MDM.
• Device platform restriction: Windows (MDM) must be set to Allow. If personally owned Windows devices are blocked, enrollment through Settings > Add work account or the Company Portal is blocked.
• Device limit: the user must be under their device limit (1 to 15, set in an Enrollment device limit restriction).
• Windows edition: Autopilot enrollment fails on Windows Home (error 0x80180022). Upgrade to Pro or higher.
• UPN: the user's UPN must use a verified, routable domain. A .local suffix breaks Group Policy auto-enrollment.

Step 1: Check automatic enrollment and MDM user scope

The same settings appear in older Learn articles as Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune in the Azure portal. If the MDM terms of use URL is blank or wrong, select Restore default MDM URLs and confirm it reads https://portal.manage.microsoft.com/TermsofUse.aspx.

1. Sign in to the Microsoft Intune admin center as a Global Administrator.
2. Go to Devices > Device onboarding > Enrollment.
3. Select the Windows tab, then select Automatic Enrollment.
4. Set MDM user scope to All, or to Some and select the groups that should enroll.
5. Leave MDM terms of use URL, MDM discovery URL and MDM compliance URL at their default values.
6. Set WIP user scope to None (or make sure no user is in both scopes).
7. Select Save.

Step 2: Check enrollment restrictions and the device limit

Restriction changes use group and filter assignments that typically sync within 15 minutes. Wait a few minutes after adding a user to a group before retrying enrollment.

1. In the Intune admin center, go to Devices > Device onboarding > Enrollment > Device platform restriction.
2. Open the Windows restriction that applies to the user (the default policy applies if no higher-priority policy is assigned).
3. Select Properties, then Edit next to Platform settings, and set Windows (MDM) to Allow. Check whether Personally owned is set to Block.
4. Select Review + save.
5. Open the Enrollment device limit restrictions policy and note the Device limit value.
6. Go to Users > All users, select the user, then select Devices, and count the enrolled devices.
7. If the count equals the limit, retire or delete stale devices or raise the limit.

Step 3: Enroll or re-enroll from the device

1. On the Windows device, go to Settings > Accounts > Access work or school.
2. If another user's work or school account is already connected, sign in as that user and select Disconnect first (this causes error 8018000a).
3. Select Connect and sign in with the user's work account. For a corporate device, choose to join the device to Microsoft Entra ID instead.
4. If the device was Entra joined but not enrolled (two device records appear in Intune), go back to Access work or school and select Connect with the same account.
5. Restart, then check the device in the Intune admin center under Devices > Windows > Windows devices.

Step 4: Read the device side (dsregcmd, Event Viewer, MDM report)

Run dsregcmd /status as the signed-in user. In Device State, AzureAdJoined : YES with DomainJoined : NO means Entra joined; both YES means Entra hybrid joined. In Tenant Details, empty MdmUrl fields mean MDM is not configured or the user is not in MDM user scope. A filled MdmUrl does not prove the device is managed. In SSO State, AzureAdPrt : NO points to a sign-in or token problem to fix before enrollment.

Open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Group Policy auto-enrollment failures show as Event ID 76 (Auto MDM Enroll: Failed) with the error code. In Task Scheduler, the related task is under Microsoft > Windows > EnterpriseMgmt.

For a full report, go to Settings > Accounts > Access work or school, select the account, select Info, then Create report, then Export. Or run the command below from an elevated prompt. Reports land in C:\Users\Public\Documents\MDMDiagnostics.

# Check join state and collect the MDM diagnostic report on the device
# Join and MDM state (run as the signed-in user)
dsregcmd /status

# Enrollment, provisioning and Autopilot logs as a zip (run elevated)
mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"

PowerShell: check the user's license and devices

Use Microsoft Graph PowerShell (not the retired MSOnline or AzureAD modules). The managed device cmdlet needs DeviceManagementManagedDevices.Read.All, and the Intune Graph API needs an active Intune license in the tenant.

# Confirm the user has an Intune service plan and list their Intune devices
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","DeviceManagementManagedDevices.Read.All"

$upn = "[email protected]"

# Licenses and any Intune service plan
Get-MgUserLicenseDetail -UserId $upn | Select-Object SkuPartNumber
(Get-MgUserLicenseDetail -UserId $upn).ServicePlans |
    Where-Object { $_.ServicePlanName -like "*INTUNE*" } |
    Select-Object ServicePlanName, ProvisioningStatus

# Devices Intune has for this user (compare count to the device limit)
Get-MgDeviceManagementManagedDevice -All -Filter "userPrincipalName eq '$upn'" |
    Select-Object DeviceName, OperatingSystem, OsVersion, ManagedDeviceOwnerType, EnrolledDateTime, LastSyncDateTime, ComplianceState

Common errors and fixes

These are the Windows enrollment errors Microsoft documents, with the cause and fix from Learn. Match the exact code or message the user sees.

A note on enrollment CNAME records

If you use automatic enrollment, you do not need the EnterpriseEnrollment CNAME. The MDM server is configured when you turn on automatic enrollment. The CNAME (EnterpriseEnrollment pointing to EnterpriseEnrollment-s.manage.microsoft.com) only helps users who enroll without automatic enrollment, so they don't have to type the server name. You can test it at Devices > Device onboarding > Enrollment > Windows tab > CNAME Validation.

How to verify it worked

If enrollment still fails, the Microsoft 365 admin center has a built-in diagnostic: go to Help & support, describe the issue (for example "I need help enrolling Windows devices"), enter the user's email and select Run tests. It reads your configuration and tells you what to fix, without changing the tenant.

1. In the Intune admin center, go to Devices > Windows > Windows devices and search for the device name. Confirm the primary user, ownership and a recent last check-in.
2. Go to Users > All users, select the user, then Devices, and confirm the device appears once (not duplicated).
3. Run dsregcmd /status and confirm AzureAdJoined : YES (or the expected hybrid state) and that the MdmUrl fields are filled.
4. Run the Get-MgDeviceManagementManagedDevice command above and confirm EnrolledDateTime and LastSyncDateTime are current.

When to call a consultant

Send us the error codes and a dsregcmd output. We'll tell you on a free call whether it's a quick setting change or a bigger cleanup.

Take the 2-min fit check Talk to a specialist

How Accred Consulting approaches it

When Windows devices won't enroll, our US-based team starts with the tenant side: licenses, MDM user scope, platform and device limit restrictions, and UPN suffixes. Most failures are a setting, not a broken device. We then pull dsregcmd output and MDM diagnostic reports from a few affected machines and match the codes to Microsoft's documented fixes. You get a written plan that covers the fix and any cleanup of stale or duplicate device records. We test on a pilot group before changing settings for everyone. After a free call we scope the work as fixed-fee or hourly.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

Sources

• Microsoft Learn: Troubleshooting Windows device enrollment problems in Intune
• Microsoft Learn: Enable MDM automatic enrollment for Windows
• Microsoft Learn: Overview of enrollment restrictions
• Microsoft Learn: Troubleshoot device enrollment in Intune