Forum Discussion
iOS Enrollment and Conditional Access
Hello everyone,
I need some help!
We are configuring Intune to allow BYOD on iOS devices using the Account Driven User Enrollment method. In this scenario, the user enrolls the device by following the path:
Settings > General > VPN & Device Management > Sign in to your Work or School Account
The enrollment process was working correctly until we configured a Conditional Access policy to ensure that only BYOD-managed devices can access company resources. In other words, only devices that have successfully completed enrollment and are marked as Compliant in Intune should be allowed to use corporate applications.
However, after applying the policy, we are no longer able to complete the enrollment process. During one of the enrollment steps, the device displays the following message:
Translate English
"Setting Up iPhone
iPhone setup may take a few minutes.Sign-In Failed
Enrollment failed. Please try again.OK"
1. Target resources (Include)
2. Target resources (Exclude)
3. Device Platform: iOS
4. Filter for devices: device.mdmAppId -notIn ["0000000a-0000-0000-c000-000000000000"]
5. Grant: Require device to be marked as compliant
This is our current Conditional Access policy configuration. Has anyone encountered this behavior before, or can identify whether there is any setting that might be blocking the enrollment process during the compliance validation stage?
1 Reply
Your enrollment works until this Conditional Access policy is enabled, so the likely issue is evaluation before the iPhone has an Entra device record, not Intune compliance itself. Microsoft documents that the compliant-device grant does not block Intune enrollment when configured as recommended. However, an unregistered device has null properties, and a negative filter such as mdmAppId -notIn applies to it. Because your policy targets all resources, a dependent enrollment sign-in may receive the compliance requirement. First, set the policy to Report-only for a pilot user and retry. Then inspect the failed Entra sign-in: Conditional Access tab, resource, failure reason, and device details. Temporarily remove the device filter for the pilot; if enrollment succeeds, redesign targeting around registered devices instead of a negative mdmAppId test. Also verify JIT registration, Microsoft Authenticator assignment, service discovery, and the enrollment profile. Keep emergency accounts excluded, then enable only after report-only results are clean.
