Intune Troubleshooting 101
Published Oct 22 2019 12:21 PM 14.2K Views

By Support as a Feature | Intune


Have you ever had a problem deploying policy to devices in Intune? Is there ever an application that you know should be on a device, that you can’t seem to get installed? As you already know – sometimes things do not go as expected for several reasons. Maybe a device was not connected to the internet to receive policy. Maybe the app failed to install because an end user uninstalled the app after it was installed. The point here is even when things are set up perfectly, sometimes there are things out of our control as administrators of the technology.


As the Troubleshooting Program Manager for Intune, I want to explain where we are today to bring awareness to troubleshooting capabilities. In addition, I’ll share improvements we are making. Through this dialog, I hope to give you a better idea of where we’re going in troubleshooting and provide a forum for you to voice your experience and feedback. For those who are attending Ignite this year – I’ll be there in person and looking for face-to-face in person feedback from this community.


Troubleshooting Blade Intent

Our customers tend to have a few simple questions we work towards answering. At a high level, my goal is that we successfully address these problems for you and empower you to self-remediate these types of issues as they are encountered:

  • What is my current configuration?
  • What is wrong?
  • What happened?
  • How do I fix it?


The Troubleshooting Blade

The Troubleshooting Blade (located under your favorites in the Device management admin portal as well as in the Azure Portal) was designed to give a helpdesk persona within your organization an “at a glance” view of one user at a time providing a snapshot of user configuration. Note that access to the blade is controlled through Role Based Access Control so that you can assign access to individual users in your organization and allow them to Troubleshoot, but perhaps not be policy creators/or configuration makers. This granularity was an intentional split as a helpdesk person who works to resolve issues for individual users and devices is not necessarily the same person that manages your entire environment.



The troubleshooting blade lets you look at the following areas today:

  • User Selection
  • Licensing & User information
  • Groups & Messages
  • Assignments
  • Devices
  • App Protection Status
  • Enrollment Failures


Here’s what you can find and troubleshoot in each area.


User Selection



In this area:

  • The first thing you must do in the troubleshooting blade is select a user. Click the “Select user to troubleshoot” button to populate the rest of the page with information to help you troubleshoot issues.


Licensing & User Information



In this area:

  • If for any reason your account status has issue – we show you at the top, along with other important alert type information. We pair this with User principal name and email address for an at a glance view of information.


Groups & Messages



In this area:

  • This shows current user selected, any alerts associated with the user after being selected, and group membership.
  • This answers the question – what is wrong with this user?
  • This view also answers the question – what groups is this user assigned to? This is very helpful when you’re trying to understand where policy under assignments area is coming from.


Icons Explained:











In this area:

  • This is meant to help answer the question – What policy is configured for this user?
  • Assignments area shows client apps, Compliance policy, Configuration policy, App protection policy, Windows 10 update rings, and Enrollment Restrictions targeted at the user.
  • You can change the view of assignments by clicking the drop down and picking from available assignments.
  • With some areas picked (but not all) clicking on these items takes you to associated UX for more details.





In this area:

  • This is meant to help answer questions:
  1. Is my device Intune compliant?
  2. Is my device Azure AD compliant?
  3. Does my device have all required applications?
  • Devices area also shows Devices enrolled by the user, Management types, Ownership, OS, OS version and last check-in. This is useful information for many different reasons.
  • If you click a device in this view – it will take you to the Device view in Intune where you can explore the device in more detail.

Azure Active Directory and Intune Compliance Icons Explained:


Compliance has been checked and device is compliant


Compliance has been checked and is not compliant


Application Install Icons Explained:


All required applications for device have been installed


Some required applications for device have not been installed



App Protection Status - note these updates are expected in the upcoming Intune release. 



In this area:

  • App Name - Admin targeted this user for policy with this Application Name.
  • Device Name/Device Type - The user has Application protection policies (also known as MAM) where the application (shown as App Name column) is installed from the device (shown as Device Name column). Device Name column would be blank if admin has targeted a policy for this user and app, but user has not yet enrolled (logged into the app the first time) to MAM from the app from any of the devices.
  • Policies - Policy Names for policies that have been delivered to user's applications.
  • Policies would state 'None' in case the user has not yet enrolled (signed into Application for the first time).

Icon Explained:

The icons in this view are simply informational. 



Enrollment Failures



In this area:

  • This is meant to show what is wrong, what happened, and recommend how to fix it.
  • Enrollment start shows time enrollment was attempted, OS shows enrollment method, OS version the OS version associated with update and failure.
  • It is possible to see a failure, but since then successfully enrolled a device. If this is the case you can see a device listed under the “Devices” area that is in a healthy state.

You can click on individual failures to then see details about the failure and recommended steps to remediate:


Again, we do plan to follow-up with more in this series so if you’ve made it this far, let us know what questions or suggestions you have for our next one! And visit us at Ignite at the Intune booth. 


Post updated:

  •  2/28/2020 and 3/2/2020 with a new informational app protection status icon and an updated screenshot for app protection status. 



1 Comment
Version history
Last update:
‎Dec 19 2023 01:30 PM
Updated by: