# Troubleshooting Device Enrollment and Management

> Chapter 10 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/troubleshooting-device-enrollment

**Official objective:** 2.5 — Troubleshoot common device enrollment and management issues

## Introduction

If a user’s new laptop can’t access corporate email on day one, the entire onboarding process grinds to a halt. For someone studying the MD-102 exam, understanding why a device fails to enrol or stops obeying company policy is the difference between a smooth first day and a frustrated call to the help desk. This chapter teaches you how to systematically diagnose and fix the most common enrollment and management failures that an Endpoint Administrator faces every day.

## The 9-1-1 Call Routing Analogy

Your office has 47 desk phones, and every employee is meant to use the same emergency number to call for help. The first time an employee dials 9-1-1, the system asks them to enter a five-digit building code. You personally enter that building code into every single phone beforehand. But when you test the system, four phones ring the fire department instead of the ambulance service, and three phones just play a busy tone.

Troubleshooting this is exactly like troubleshooting device enrollment in Microsoft Intune. The phones are your end-user devices. The emergency number is your enrollment server. The building code is the enrollment profile that tells the device exactly what policies and apps to receive once it connects. When a phone fails to route properly, you check if the building code was typed correctly (profile misconfiguration), if the phone’s wiring is loose (network connectivity), or if the phone itself is too old to support the system (unsupported OS version). You don’t start by replacing all the phones — you start by checking one phone’s settings systematically. In Intune, you approach a failed enrollment the same way: check the device’s date and time, ensure it can reach the internet, verify the user has a valid license, and confirm the enrollment profile is assigned correctly.

## Core explanation

To understand troubleshooting device enrollment and management, you first need to understand what enrollment actually is. When a user gets a new Windows laptop or an iPhone for work, that device is a blank slate. It has no idea that it belongs to your company. Enrollment is the process of telling that device, "Hey, you are now a managed device. You must follow company rules." The tool that does this is called Microsoft Intune. Intune is a cloud-based service, meaning it runs on Microsoft’s servers, not on a computer in your building. When a device enrols, Intune pushes down a set of policies. These policies control things like requiring a PIN to unlock the screen, forcing encryption of the hard drive, or automatically installing specific apps like Microsoft Teams.

There are two main paths a device can take to enrol. The first is called user-driven enrollment. This is when a person signs into their work account on their device, and the device automatically connects to Intune. The second is called automatic enrollment. This happens when a company buys devices from a supplier like Dell or Apple, registers them in Intune before they ever reach the user, and the device automatically enrols the first time it connects to the internet. For Windows devices, this can be done through a feature called Windows Autopilot. For Apple devices, it is called Apple Business Manager. Microsoft Entra ID, which is Microsoft's cloud-based identity service, is the system that verifies who the user is and whether they are allowed to enrol.

So what goes wrong? The most common failure points fall into these categories:

- Licensing issues: every user who enrols a device must have a license assigned to them in the Microsoft 365 admin centre. If the user does not have a license, the device will refuse to enrol.
- Network connectivity: the device must be able to reach the internet and specifically the Microsoft Intune servers. If it is behind a firewall that blocks certain web addresses, enrollment will time out.
- Date and time settings: Intune uses certificates to secure the connection. If the device's clock is wrong, the certificate will be considered invalid, and enrollment will fail. This is one of the most overlooked causes.
- Enrollment restrictions: an administrator can set rules that block certain types of devices, like personal phones or devices running an old version of Windows. If the device is blocked, the user will see an error message.
- Profile mismatch: the enrollment profile tells Intune what settings to apply. If the profile is assigned to the wrong group of users or contains an error, the device might enrol but then not receive the correct configuration.

Once a device is enrolled, the troubleshooting does not stop. Management issues happen when devices stop obeying policies. For example, a user might remove the company email account from their phone, or they might disable the device PIN. Intune can detect these changes and either warn the user or block access to company data. If a device stops checking in with Intune — meaning it hasn't sent a status update in 30 days — Intune marks it as noncompliant. You then need to determine why the device stopped communicating. Common causes include the user uninstalling the Company Portal app, a factory reset, or a network change that breaks the connection.

You troubleshoot these problems using a hierarchy. Start with the simplest check: is the device online? Is the user licensed? Is the date correct? Then move to the more complex checks: are all required URLs allowed through the firewall? Is the enrollment profile assigned? Is there a certificate problem? The Microsoft Intune admin console provides logs and reports that show you exactly what happened during an enrollment attempt. You can also run a diagnostic tool on the device itself. For Windows, that tool is built into the Settings app. For iOS and Android, the Company Portal app has a built-in diagnostic report.

The purpose of all this troubleshooting is not just to fix one device — it is to find patterns. If ten devices fail enrollment with the same error, the problem is probably a configuration error, not a hardware fault. If only one fails, it is likely a specific device problem like wrong date and time. Understanding this distinction helps you fix the root cause quickly and prevents dozens of other users from hitting the same issue.

## Real-world context

Imagine you are the new IT administrator at a medium-sized company called Northern Lights Consulting. You have 200 employees, and your boss tells you that 15 new laptops have arrived from Dell. They are meant to be enrolled using Windows Autopilot. You have already gone into the Microsoft Intune admin centre, imported the device serial numbers that Dell provided, and created an Autopilot deployment profile. You have assigned that profile to a security group called All Employees. The new laptops arrive, and your boss hands them out.

By lunchtime, you get six calls. Three users say their laptop booted up, but it never got past a blue screen that says "Getting your device ready." Two users say the laptop went straight to the normal Windows desktop instead of showing the company logo. One user says the laptop asked for a Microsoft account, not a work account. Your job is to figure out why each scenario is happening.

For the three users stuck on the blue screen, you check the Intune admin console. You go to Devices > Enrollment > Autopilot and look at the device list. You see that those three devices show a status of "Pending" or "Assigned" — never "Provisioned." This tells you that the devices are registered with Autopilot, but they are not connecting to the internet. You ask the users if they plugged in the Ethernet cable or connected to Wi-Fi. They all say they clicked the Wi-Fi icon, but the network name did not appear. You discover that the Wi-Fi driver is not installed yet. Windows Autopilot needs an internet connection to download the profile, and without drivers, it cannot connect. You find the driver files, load them onto a USB stick, and have each user install them before restarting. The enrollment now works.

For the two users whose laptops showed the normal Windows desktop, you check the same list. Those device serial numbers are not listed at all. This means the IT team did not upload those serial numbers to Intune. You call Dell and confirm that two extra laptops were shipped by mistake — they were never added to the Autopilot programme. You manually upload the new serial numbers into Intune, re-assign the profile, and have those users reset their laptops.

For the user who was asked for a Microsoft account, you recognise this as a classic licensing issue. You open the Microsoft 365 admin centre, find that user in the user list, and see that they have no license assigned. The user is a new hire and your HR team forgot to provision them. You assign a Microsoft 365 E3 license to the user, and on the next restart, the laptop correctly asks for the user's work email address. Enrollment proceeds smoothly.

The key lesson from this scenario is that each failure pointed to a different layer of the troubleshooting stack: hardware drivers (physical layer), device registration (device layer), and user licensing (identity and licensing layer). By following a systematic process, you fixed all six computers before the end of the day without reinstalling a single operating system.

## Exam focus

The MD-102 exam tests troubleshooting device enrollment and management in a very specific way. You will not be asked to diagnose a live network. Instead, you will be given a scenario — often a short paragraph describing a failure — and asked to choose the correct root cause from a list of four or five possible answers. The exam writers love three things: licensing errors, certificate errors, and network URL blokage.

Here are the exact concept areas you must master:

- Know the difference between user-driven enrollment and automatic enrollment. The exam will give you a scenario like, "A user tries to enrol their Windows 10 device from Settings > Accounts > Access work or school, and it fails. What is the most likely cause?" The answer often relates to the user not having an Intune license or the device not being Azure AD joined.
- Understand the required URLs for Intune enrollment. The exam expects you to know that devices must be able to reach manage.microsoft.com, login.microsoftonline.com, and a few others. If a firewall blocks these, enrollment fails. They will not provide a list of URLs — they expect you to recognise the pattern.
- Recognise the symptoms of a certificate problem. If a device fails enrollment and the error message mentions "certificate" or "trust", the answer is almost always that the certificate is not trusted by the device or that the device's date and time are wrong, which invalidates the certificate.
- Know the difference between a compliance policy and a configuration profile. A compliance policy checks if the device is following rules (like having a PIN). A configuration profile actually sets settings (like automatically configuring Wi-Fi). The exam might ask, "A device is enrolled but not receiving Wi-Fi settings. What should you check?" The answer is the configuration profile, not the compliance policy.
- Be aware of enrollment restrictions. The exam presents a scenario where a personal Android phone cannot enrol. The answer typically involves checking whether personal devices are allowed via the enrollment restriction settings.

Common traps the exam sets include:

- They will present a symptom that looks like a device problem (e.g., "Wi-Fi is not working") but the real cause is a missing Intune license. Always check licensing first in the exam.
- They will use outdated language. For example, they might say "Azure AD" in the question. Remember that the correct term is now Microsoft Entra ID. Answer options that use the old name are not incorrect per se, but the exam will use the correct terminology in the correct answer.
- They will offer plausible but wrong answers like "The device needs to be reformatted" or "The user needs admin rights." These are almost never correct for MD-102 troubleshooting questions. The answer is almost always a specific configuration issue.
- They will test your understanding of the Windows Autopilot reset process. If a device was previously enrolled and is being reused, you must wipe the device before it can re-enrol. The answer option that says "reset the device from Intune" is often correct.
- They will confuse you with multi-factor authentication (MFA). MFA can block enrollment if the user fails to complete the second factor, but the exam will clearly state if MFA is part of the scenario. If they do not mention MFA, it is not the answer.

To prepare, memorise the exact sequence of what happens during enrollment: the device checks connectivity, authenticates with Microsoft Entra ID, verifies the license, downloads the enrollment profile, applies policies, and then reports back. Each step has a specific failure mode, and matching the symptom to the step is the key to passing these questions.

## Step by step

1. **Check user license assignment** — Open the Microsoft 365 admin centre and verify the user has an Intune license assigned. Without a license, the user’s device will be rejected during enrollment. This is the single most overlooked step in troubleshooting.
2. **Verify device date, time, and time zone** — On the device, open the date and time settings. If the clock is off by more than five minutes, Intune’s certificate checks will fail. This is a common issue on devices that have been stored or are connected to a network without NTP (Network Time Protocol).
3. **Test network connectivity to Intune services** — The device must reach specific URLs like manage.microsoft.com and login.microsoftonline.com. Use a web browser on the device to test these addresses. If they do not load, the firewall or proxy is blocking enrollment. Check with the network team to allow these URLs.
4. **Review enrollment restrictions in Intune** — In the Intune admin centre, navigate to Devices > Enrollment > Enrollment restrictions. Check if the device platform (e.g., Windows, iOS) is allowed, and if personal devices are blocked. If the policy blocks the device, the user will see a generic error message.
5. **Inspect the Windows Autopilot device list (if applicable)** — For Autopilot enrollment, go to Devices > Enrollment > Windows enrollment > Devices. Confirm the device serial number appears with a status of "Assigned" or "Provisioned." If it is missing or shows "Unassigned", the device was not registered correctly with Microsoft.
6. **Run the Intune diagnostic report on the device** — On a Windows device, go to Settings > Accounts > Access work or school, click the enrolled account, then click Info. Click "Create report" to generate a diagnostic log. On iOS or Android, use the Company Portal app’s Send Diagnostics option. These logs show exact error codes and help pinpoint the failure.

## Comparisons

### Enrollment vs Management

**Enrollment:**
- Happens once when the device first connects to Intune.
- Focuses on establishing the connection and applying initial settings.
- Fails if licenses, network, or date/time are incorrect.

**Management:**
- Happens continuously after enrollment is complete.
- Focuses on enforcing policies and checking compliance over time.
- Fails if the device stops communicating or the user changes settings.

### User-Driven Enrollment vs Automatic Enrollment (Autopilot)

**User-Driven Enrollment:**
- The user manually signs into their work account on the device.
- Works on any device that supports Intune enrollment.
- Requires the user to follow steps in Settings or Company Portal.

**Automatic Enrollment (Autopilot):**
- The device is pre-registered by the IT team and enrols without user input.
- Only works on devices purchased through an approved reseller and registered with Microsoft.
- The user only needs to power on and connect to the internet.

### Compliance Policy vs Configuration Profile

**Compliance Policy:**
- Checks if the device follows rules (e.g., PIN enabled).
- Does not change settings itself — only reports rule violations.
- Triggers conditional access to block noncompliant devices.

**Configuration Profile:**
- Actually applies settings to the device (e.g., sets Wi-Fi password).
- Modifies the device configuration automatically.
- Does not block access — it just configures the device.

### Microsoft Intune vs Microsoft Entra ID

**Microsoft Intune:**
- Manages device policies, apps, and compliance.
- Pushes configurations to enrolled devices.
- Focused on the device itself.

**Microsoft Entra ID:**
- Manages user identity, authentication, and access control.
- Verifies who the user is and what they can access.
- Focused on the user and their account.

### Enrollment Error (Certificate/Trust) vs Enrollment Error (Network Timeout)

**Enrollment Error (Certificate/Trust):**
- Caused by incorrect date/time or invalid certificates.
- Error message often mentions 'certificate' or 'trust relationship'.
- Fix by correcting system clock or renewing certificates.

**Enrollment Error (Network Timeout):**
- Caused by blocked URLs or slow internet connection.
- Error message often says 'Cannot connect to server' or times out.
- Fix by allowing required URLs in firewall or checking cable connections.

## Diagram

_This flowchart shows the step-by-step process a device follows during enrollment and management, highlighting the decision points where failures most commonly occur._

```mermaid
flowchart TD
    A[User opens device] --> B{Can device reach internet?}
    B -- Yes --> C[Device contacts Microsoft Entra ID]
    B -- No --> D[Check Wi-Fi drivers or Ethernet]
    C --> E{User has valid Intune license?}
    E -- Yes --> F[Device downloads enrollment profile]
    E -- No --> G[Assign license in admin centre]
    F --> H[Apply compliance policies]
    H --> I[Device reports status to Intune]
    I --> J{Device compliant?}
    J -- Yes --> K[User can access company resources]
    J -- No --> L[Block access until fixed]
```

## Common misconceptions

- **Misconception:** If a device is enrolled via Windows Autopilot, it cannot have any errors, because Microsoft handles everything automatically. **Reality:** Autopilot only automates the initial setup. The device still needs a working internet connection, up-to-date drivers, and a valid user license. If any of those are missing, Autopilot fails. (Beginners see the word 'automatic' and assume it is magic. They do not realise that automatic just means the process is scripted — the underlying dependencies remain the same.)
- **Misconception:** A device that is 'noncompliant' in Intune can still access all company data normally. **Reality:** Noncompliant means the device has broken a company rule (like no PIN). Intune can block access to email, OneDrive, and other company resources until the device is fixed. (New administrators think compliance is just a report. They do not realise it triggers conditional access policies that actually enforce the rules.)
- **Misconception:** If a device cannot enrol, the first thing to do is factory reset the device. **Reality:** A factory reset should be the last resort. Start with simple checks like date and time, internet connectivity, user license, and enrollment restrictions. A reset wipes the device and often does not fix configuration errors on the server side. (Resetting feels like a 'clean start' and is a common troubleshooting reflex from consumer device use. In enterprise IT, the root cause is usually a server-side setting, not a device fault.)
- **Misconception:** Microsoft Entra ID and Intune are the same service, so if one is working, the other must be working too. **Reality:** They are separate services. Microsoft Entra ID handles user identity and authentication. Intune handles device management policies. A user can successfully log in to Microsoft Entra ID but still fail to enrol in Intune because of a licensing or profile issue. (Beginners see both listed in the same admin portal and assume they are one product. This misunderstanding leads them to waste time troubleshooting the wrong service.)
- **Misconception:** Once a device is enrolled and working, it will never need troubleshooting again. **Reality:** Devices can go 'offline' from Intune, become noncompliant, or have policies fail to apply after updates. Management requires ongoing monitoring, especially after OS updates or network changes. (New admins treat enrollment as a one-time event. They do not realise that Intune continuously checks for compliance, and changes on the device (like a user disabling a setting) can break management at any time.)

## Key takeaways

- Enrollment is the act of registering a device with Microsoft Intune so it can receive company policies; management is the ongoing enforcement of those policies after enrollment.
- The most common enrollment failure causes are a missing or expired user license, incorrect date and time on the device, and blocked network URLs — check these in that order.
- Windows Autopilot automates the first boot of a new device, but it still requires drivers for network connectivity and a valid user license.
- A device that is noncompliant in Intune has broken a company policy and may be blocked from accessing corporate resources like email and OneDrive.
- Troubleshooting must start with the simplest fix (check date and time) before moving to complex server-side changes like reconfiguring enrollment profiles.
- Intune uses certificates to secure communication; an incorrect system clock will invalidate those certificates and cause enrollment to fail with a trust error.
- Enrollment restrictions can block personal devices or devices running outdated operating systems — always check these settings before assuming the device is broken.
- The difference between a configuration profile and a compliance policy is that configuration profiles set settings, while compliance policies check if settings are being followed.

## FAQ

**Why does my device say 'Not compliant' in Intune, even though I have a PIN set?**

The compliance policy might require a PIN length of 6 digits, and yours is only 4. Or it might require a PIN on both the lock screen and on boot. Check your compliance policy settings in Intune for the exact requirements.

**How do I fix a device that is stuck on 'Getting your device ready' during Autopilot?**

This usually means the device cannot connect to the internet. Press Shift+F10 to open a command prompt, then type 'ipconfig' to see if the device has an IP address. If not, check Wi-Fi drivers or plug in an Ethernet cable and restart the device.

**What is the difference between an enrollment profile and a compliance policy?**

An enrollment profile controls what happens during device setup (like which apps to install). A compliance policy checks the device’s ongoing health (like whether it has a PIN or encryption enabled). They are applied at different times and serve different purposes.

**Can I enrol a personal iPhone into Intune without wiping it?**

Yes. Apple supports user-approved enrollment, which is also called BYOD (Bring Your Own Device) enrollment. This enrols the device for management without a factory reset. The user keeps their personal data separate from company data.

**Why does my user get an error saying 'This device is already enrolled'?**

The device may have been previously enrolled by another user or under a different company account. You must reset or wipe the device in Intune before it can be re-enrolled. Alternatively, the user might be trying to enrol the same device again after an unenrollment.

**How do I check if a user has an Intune license in Microsoft 365?**

Go to the Microsoft 365 admin centre, click Users > Active users, select the user, and look at the Licenses and apps tab. You must assign a license that includes Microsoft Intune, such as Microsoft 365 E3 or a standalone Intune license.

**What does it mean when a device is 'pending' in the Autopilot list?**

A 'pending' status means Intune has recognised the device serial number but has not yet pushed the deployment profile to it. This often happens when the device has not checked in yet or the profile assignment is delayed. It usually resolves within 24 hours or after the device restarts.

## Check your understanding

1. **What is the most common cause of an enrollment failure that shows a certificate or trust error?**

   Answer: The device’s date and time are incorrect, which invalidates the SSL certificate used to secure the connection to Intune.

2. **What is the difference between a compliance policy and a configuration profile in Intune?**

   Answer: A compliance policy checks if the device meets rules (like having a PIN), while a configuration profile actually applies settings to the device (like setting Wi-Fi or email settings).

3. **If a Windows device fails to enrol using Autopilot and is stuck on a blue screen saying 'Getting your device ready', what is the most likely cause?**

   Answer: The device cannot connect to the internet, often because the Wi-Fi driver is missing or the Ethernet cable is unplugged.

4. **A user reports that their personal Android phone cannot enrol in Intune. What should you check first in the admin centre?**

   Answer: Check the enrollment restrictions in Intune to see if personal (BYOD) Android devices are allowed.

5. **What does it mean if a device is marked as 'noncompliant' in Intune?**

   Answer: It means the device has violated at least one compliance policy rule, such as not having a PIN enabled or not having encryption turned on, and may have access to company resources blocked.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/troubleshooting-device-enrollment