Endpoint privilege management, deployment unsuccessful with "device health monitoring" error

[MaxMorsia]

Hello all, I'm testing Endpoint privilege management on a few machines in a test environment. The elevation settings policy isn't deploying when "send data to microsoft" is selected, the error received mentions an "Allow Device Health Monitoring" error, but that settings is correctly deployed via configuration profiles. Also can't find any info about that in the logs.

If I deselect "send data to microsoft" then the policy is deployed successfully, but in reality the app is not installed on the target devices (so no right click options about EPM). Anyone facing the same issue, and what steps could we try to fix it?

[#2]

I am using Hyper-V on Windows 10 as a host for the VM - where woud I go to turn SSL inspection off?

[#3]

Did you also looked in de device configuration policy event log, there should be somethint mentioned in it… i am going to find out what that error means (its obvious of course but lets take a look in the code)

[#4]

DualEnrollMmpcUsingAADCredential failed) HRESULT:(The endpoint address URL is invalid.) Function Name: (MmpcDiscoveryUrl) HRESULT:(The endpoint address URL is invalid.)

[#5]

Event 4022 Failed to enroll MMP-C for dual enrollment mode. Result: (The endpoint address URL is invalid.).

[#6]

@Rudy_Ooms_MVP This what I am seeing in the event log on the affected device: 

[#7]

THe mmpcdiscoverurl function should kick of a function getdiscoveryurl It should reach out to

https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0
Can you verify this domain is reachable? and of course if the certificate matches the names

[#8]

nothing usefull before that error? or what is the last message you notice before it gives you that error

[#9]

MMP-C: Device permission to select target MMP-C environment is (false).
Event 2600

[#10]

When I ping https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0
Ping request could not find host

[#11]

if the link is https open it in a browser if you need to ping it
ping discovery.dm.microsoft.com

[#12]

The two entries preceding are:
MMP-C: Found a certificate whose SPKI matched one of the expected pinned certs.
Log Name: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
MMP-C: MMP-C environment to target. URL: (https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0), Environment: (0x3).

[#13]

when i ping it I get destination host unreachable, https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0 will not open in the browser, I have a VM that I tested in another tenant and EPM works fine in the other tenant but not the tenant i'm currently using.

[#14]

mmm if that page doesnt open (should give you a blank page... compare it with a device that works..) and the ping discovery.dm.microsoft.com gives you that error... it should give you something like this
Reply from 40.114.229.17: Destination host unreachable.
(compare it with the device that works)

DNS ?

[#15]

Pinging pedmdiscoveryna01.westus2.cloudapp.azure.com [20.80.187.73] with 32 bytes of data:
Reply from 20.80.187.73: Destination host unreachable.
Reply from 20.80.187.73: Destination host unreachable.
Reply from 20.80.187.73: Destination host unreachable.
Reply from 20.80.187.73: Destination host unreachable.

[#16]

@Ztdid 

So this are the errors you are getting in order right?

So the last one is the  endpoint address uri is invalid?

[#17]

Thats correct I'm getting all three of those errors in that order.

[#18]

Do you have an output of winver(version/build of windows) and the device is aadj? And can you check if enrollment.dm.microsoft.com is also reachable as that should be the URI it needs to discover (that fails)

[#19]

@Rudy_Ooms_MVP and @Ztdid 

I've been having the same issue for weeks now. I have an MS support case open (for weeks) but haven't gotten very far with a resolution. 

[#20]

Here's what I'm seeing in a constant loop, every 5 mins.

In order:

•  MMP-C: Device permission to select target MMP-C environment is (false).

• MMP-C: MMP-C environment to target. URL: (https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0), Environment: (0x3).

• MMP-C: Found a certificate whose SPKI matched one of the expected pinned certs.

• Failed to enroll MMP-C for dual enrollment mode. Result: (The endpoint address URL is invalid.

[#21]

Mmm okay.. if someone could install fiddler on his device, enable https decyrption and watch the repsons… i am all ears!!!! (I ran fiddler as the current user with admin permissions)

Because it should show you the discovery (which succeeds as it mentions the cert pinning)  but I am wondering what happens or what it mentions in the response( as it should mention the enrollment.dm part) 

Feel free to reach out on teams: email address removed for privacy reasons