Intune Enrollment Pending ESP Profile
You are troubleshooting an Intune enrollment issue on a Windows 10 device. The device is Microsoft Entra joined, but the enrollment status shows 'Pending'. What is the most likely cause?
Quick Answer
The answer is that the Enrollment Status Page (ESP) profile is not assigned to the device. This is the most likely cause because the ESP is designed to track and block the device setup process until required policies and apps are installed; when no ESP profile is assigned, the enrollment process can stall in a “pending” state while waiting for a configuration that never arrives. On the MD-102 exam, this scenario tests your understanding of the enrollment lifecycle and the specific role of ESP profiles in Windows 10 Autopilot and Entra joined devices—a common trap is confusing a pending ESP with MDM authority issues or compliance policy failures, but remember that ESP assignment is a prerequisite, not a post-enrollment step. A helpful memory tip: “ESP must be assigned, or enrollment is left hanging.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Enrollment Status Page (ESP) profile is not assigned to the device.
The Enrollment Status Page (ESP) tracks the installation of profiles, policies, and apps during enrollment. If the ESP profile is not assigned to the device, the enrollment process may hang in a 'Pending' state waiting for the ESP configuration. Option A is incorrect because conditional access policies are evaluated after enrollment, not during. Option B is incorrect because BitLocker is a disk encryption feature unrelated to enrollment status. Option D is incorrect because the MDM authority is set at the tenant level; if it were not set to Intune, enrollment would fail entirely, not just show 'Pending'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is not compliant with a conditional access policy.
Why it's wrong here
Compliance is checked after enrollment, not during.
- ✗
The device does not have BitLocker enabled.
Why it's wrong here
BitLocker is not a prerequisite for enrollment.
- ✓
The Enrollment Status Page (ESP) profile is not assigned to the device.
Why this is correct
ESP profiles can cause the enrollment to hang in 'Pending' if not configured or if there is a timeout.
- ✗
The MDM authority is not set to Intune.
Why it's wrong here
If MDM authority were incorrect, enrollment would likely fail entirely, not show 'Pending'.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that their Windows 11 device fails to enroll in Microsoft Intune. The device is Microsoft Entra joined and the user has a valid Intune license. What should you check first?
medium- A.Verify that BitLocker is enabled on the device.
- ✓ B.Check the Enrollment Status Page (ESP) profile configuration in Intune.
- C.Ensure that the device has a local administrator password set.
- D.Review the Windows Autopilot deployment profile assigned to the device.
Why B: Enrollment Status Page (ESP) profiles can block enrollment if misconfigured, and checking the Intune console is the first step to see errors. Option A is wrong because BitLocker is not related to enrollment. Option C is wrong because the local admin password is not required for enrollment. Option D is wrong because the Autopilot profile is only relevant for Autopilot deployments, not general enrollment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.