Intune Enrollment Issues - Error `0x80180014`
Hello Community! We've been occasionally getting this error with some of our machines when trying to manually enroll them in Intune: Error `0x80180014` with the message "does not support this version of Windows" From what I've seen, it typically happens to very specific devices. We have our enrollment setup for Corporate only devices, and they have to have already been synced into Entra form our "on prem" AD. We have found that when removing that restriction, the devices can be enrolled as 'personal' devices. We've made sure the devices are fully updated as well. We've tried doing everything from scratch, including deleting the device from Intune, Entra, and AD before trying to re-enroll it. Here is a dsregmcd output of one of the enrollment attempts: H:\>dsregcmd /status +----------------------------------------------------------------------+ | Device State | +----------------------------------------------------------------------+ AzureAdJoined : YES EnterpriseJoined : NO DomainJoined : YES DomainName : CLEARBROOK Virtual Desktop : NOT SET Device Name : CBROOK13289LP.clearbrook.org +----------------------------------------------------------------------+ | Device Details | +----------------------------------------------------------------------+ DeviceId : 1c9069dc-0079-4c49-b827-227e3a886c6b Thumbprint : D1066B4BCBA9FBFD63F66190741B1BDD32C36C0F DeviceCertificateValidity : [ 2026-07-24 19:46:23.000 UTC -- ] KeyContainerId : e1d94bb2-b3f6-4e6c-93ce-319aeb6e219c KeyProvider : Microsoft Platform Crypto Provider TpmProtected : YES DeviceAuthStatus : SUCCESS +----------------------------------------------------------------------+ | Tenant Details | +----------------------------------------------------------------------+ TenantName : CLEARBROOK TenantId : f3c206ca-21c6-4c72-9ab6-76aa22775cd0 AuthCodeUrl : https://login.microsoftonline.com/f3c206ca-21c6-4c72-9ab6-76aa22775cd0/oauth2/authorize AccessTokenUrl : https://login.microsoftonline.com/f3c206ca-21c6-4c72-9ab6-76aa22775cd0/oauth2/token MdmUrl : MdmTouUrl : MdmComplianceUrl : SettingsUrl : JoinSrvVersion : 2.0 JoinSrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/device/ JoinSrvId : urn:ms-drs:enterpriseregistration.windows.net KeySrvVersion : 1.0 KeySrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/key/ KeySrvId : urn:ms-drs:enterpriseregistration.windows.net WebAuthNSrvVersion : 1.0 WebAuthNSrvUrl : https://enterpriseregistration.windows.net/webauthn/f3c206ca-21c6-4c72-9ab6-76aa22775cd0/ WebAuthNSrvId : urn:ms-drs:enterpriseregistration.windows.net DeviceManagementSrvVer : 1.0 DeviceManagementSrvUrl : https://enterpriseregistration.windows.net/manage/f3c206ca-21c6-4c72-9ab6-76aa22775cd0/ DeviceManagementSrvId : urn:ms-drs:enterpriseregistration.windows.net +----------------------------------------------------------------------+ | User State | +----------------------------------------------------------------------+ NgcSet : NO WorkplaceJoined : NO WamDefaultSet : YES WamDefaultAuthority : organizations WamDefaultId : https://login.microsoft.com WamDefaultGUID : {B16898C6-A148-4967-9171-64D755DA8520} (AzureAd) +----------------------------------------------------------------------+ | SSO State | +----------------------------------------------------------------------+ AzureAdPrt : YES AzureAdPrtUpdateTime : 2026-07-24 20:19:05.000 UTC AzureAdPrtExpiryTime : 2026-08-07 20:19:04.000 UTC AzureAdPrtAuthority : https://login.microsoftonline.com/f3c206ca-21c6-4c72-9ab6-76aa22775cd0 EnterprisePrt : NO EnterprisePrtAuthority : OnPremTgt : NO CloudTgt : YES KerbTopLevelNames : .windows.net,.windows.net:1433,.windows.net:3342,.azure.net,.azure.net:1433,.azure.net:3342 +----------------------------------------------------------------------+ | Diagnostic Data | +----------------------------------------------------------------------+ AadRecoveryEnabled : NO Executing Account Name : CLEARBROOK\blopez1, email address removed for privacy reasons KeySignTest : PASSED DisplayNameUpdated : YES OsVersionUpdated : YES HostNameUpdated : YES Last HostName Update : NONE +----------------------------------------------------------------------+ | IE Proxy Config for Current User | +----------------------------------------------------------------------+ Auto Detect Settings : YES Auto-Configuration URL : Proxy Server List : Proxy Bypass List : +----------------------------------------------------------------------+ | WinHttp Default Proxy Config | +----------------------------------------------------------------------+ Access Type : DIRECT +----------------------------------------------------------------------+ | Ngc Prerequisite Check | +----------------------------------------------------------------------+ IsDeviceJoined : YES IsUserAzureAD : YES PolicyEnabled : NO PostLogonEnabled : YES DeviceEligible : YES SessionIsNotRemote : YES CertEnrollment : none PreReqResult : WillNotProvisionPlatform SSO + Secure Enclave: True Passwordless macOS Sign-in with Entra ID?
Hi all, I'm testing macOS DEP/ADE + Intune + Platform SSO with Microsoft Entra ID. I have the Mac successfully enrolling through ADE, becoming Entra joined, and users can authenticate against Entra ID. With Platform SSO configured for Password authentication, users can sign in using their Entra password and everything works as expected. What I'm trying to achieve is a passwordless experience using Secure Enclave, similar to Windows Hello for Business: User enrolls the Mac via ADE Device joins Entra ID Platform SSO is registered Authentication uses Secure Enclave / biometrics (Touch ID) User is no longer prompted for their Entra password during normal sign-in/unlock scenarios Has anyone successfully implemented this with Intune and Platform SSO? Specifically: Is a true Windows Hello-like passwordless experience currently supported on macOS with Entra ID + Platform SSO? If yes, what authentication method and Platform SSO configuration are required? Are there any known limitations where Entra authentication still requires the cloud password even when Secure Enclave is configured? I'm interested in real-world deployments and lessons learned. Thanks!
RemoteHelp.exe reports FileVersion 10.4.10008.1000 while the product version is 5.2.1037.0
Problem 1 - File Version Because RemoteHelp.exe reports FileVersion 10.4.10008.1000 while the product version is 5.2.1037.0, this makes Intune detection, packaging, inventory reporting, and supersedence unnecessarily difficult. Remote Help publishes release versions such as 5.2.1037.0, but the primary executable reports a different FileVersion (10.4.10008.1000). This prevents administrators from using standard file-version detection methods in Intune, Configuration Manager, and software inventory solutions. Administrators must instead enumerate uninstall registry entries and distinguish between the Burn bundle and MSI entries. Aligning the executable FileVersion/ProductVersion with the published release version would significantly simplify enterprise application management. Remote Help combines both common enterprise packaging mistakes: The executable version doesn't match the advertised product version. The installer creates two uninstall entries with the same DisplayName. Neither issue is fatal, but together they make what should be a trivial Intune detection rule far more complicated than it needs to be. From an enterprise management perspective, this causes several problems: Application detection scripts become more complicated. Supersedence rules are harder to create. Administrators waste time investigating apparent version mismatches. Software inventory reports show different versions depending on which source is queried. Automated packaging systems cannot simply use file versioning. Documentation has to explicitly state "do not use the EXE version". Problem 2 - Duplicate Uninstall entries The Burn bootstrapper situation makes it even more confusing because there are two uninstall entries, both called Remote Help, both reporting version 5.2.1037.0, but representing two different installer components. This isn't unique to Remote Help unfortunately. Microsoft has a history of doing similar things with: Company Portal Teams (various generations) Edge WebView2 Visual Studio bootstrapper installers Azure VPN Client Some Defender components where the executable version represents the underlying codebase rather than the product release version that administrators actually deploy. The file version should be treated as an API contract with administrators. Once an application is broadly managed by enterprises, changing versioning schemes or exposing an internal build number instead of the published product version makes lifecycle management considerably harder than it needs to be. Problem 3 - Unversioned download URL The URL to download the latest version https://aka.ms/downloadremotehelp is only a redirect link, not a versioned artefact. The download URL itself does not expose any metadata about: The current Remote Help version The release date When the installer was last updated Previous versions A changelog Microsoft's documentation simply points administrators to the download link for installation. When you download the 'latest version' you always receive whatever Microsoft currently considers the latest installer, but the URL itself provides no version information. For enterprise deployment scenarios, the ideal solution would be one of: A "What's New" page with version history. A release notes page containing: Version Release date Changes Versioned download URLs, for example: RemoteHelp-5.2.1037.0.exe RemoteHelp-5.2.1037.0.msi Please can these three issues be resolved to ease some of the unnecessary burden placed on Intune Administrators?Windows 11 + Intune: restrict devices to MDM-managed Wi-Fi profiles only
I was trying to solve a problem for our school exam laptops potentially accessing student phones as hotspots and thought I'd share the results in case it helps someone else. Environment Windows 11 Education 25H2 Microsoft Entra Joined (cloud only) Microsoft Intune Standard users (no local admin) Intune Wi-Fi profiles deployed normally Goal Prevent students from using personal hotspots or home Wi-Fi while still allowing normal Windows logon and access to approved school wireless networks. Most discussions I found concluded that the old "Allow only these SSIDs" WLAN Group Policy isn't available for Entra-only devices. Configuration Custom Intune profile using the Wi-Fi Policy CSP: ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFi = 1 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowManualWiFiConfiguration = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowWiFiDirect = 0 ./Device/Vendor/MSFT/Policy/Config/Wifi/AllowAutoConnectToWiFiSenseHotspots = 0 The important setting appears to be: AllowManualWiFiConfiguration = 0 Microsoft describes this as: No Wi-Fi connection outside of MDM provisioned network is allowed. What I observed Before policy: Student Wi-Fi visible Staff Wi-Fi visible Home Wi-Fi visible Phone hotspot visible Neighbour Wi-Fi visible After policy: ✔ Student Wi-Fi (deployed by Intune) visible ✔ Test hotspot profile (also deployed by Intune) visible ❌ Phone hotspot not deployed by Intune hidden ❌ Home Wi-Fi hidden ❌ Neighbour Wi-Fi hidden The device automatically connected to managed Wi-Fi profiles and failed back correctly when one disappeared. Students only saw Wi-Fi profiles that had been deployed through Intune. I have now rolled it out to one of our laptop carts and it has worked flawwlessly for the last week. Unexpected result I originally thought this setting simply prevented users creating new Wi-Fi profiles. Instead it appears (at least in our environment) to hide every unmanaged SSID and only expose MDM-managed Wi-Fi profiles. That effectively solved the hotspot problem without kiosk mode or AppLocker, meaning I can apply it to all school managed student devices now too. Has anyone else seen the same behaviour? I'd be interested to know if this is consistent across: Windows 11 Pro Enterprise Hybrid Entra Join Different Wi-Fi adapters 24H2 vs 25H2
Intune partner compliance onboarding
Hello, We develop a MDM solution and we would like to become device compliance partner to offer our customers conditionnal access functionality. After filling twice (the first time almost two month ago) the form "Intune partner compliance onboarding request" whose link is available on this page https://learn.microsoft.com/en-us/intune/device-security/compliance/third-party-partners, we didn't get any reply to our request. Would you know if there is any other way to integrate this partnership ? Any contact or anything to get some news about our request ? Thank you for your help. Best regards,
INTUNE: Problems with the Google address (Managed Google Play)
Hello everyone, Ever since we added our email address under “Managed Google Play” (in the Intune Admin Center), we can no longer use that address to sign in to Google, Google Docs, Google Drive, or similar services... Is this normal? - If not, what settings do I need to adjust, and where, to get it working again? The error message looks something like this: "Error message: We’re sorry, but you don’t have access to Google Docs. Please log in to your Admin Console to enable it" Thanks and best regards Chris
Advanced Microsoft Intune capabilities - Coming to Education A5?
The Advanced Microsoft Intune capabilities (what was the Intune Suite has now arrived for E5 customers (and some of the features to E3 customers. Can anyone give any clarity as to if/when these features will be coming to A5 customers? I can see we seem to have some of the features (Remote Help, Endpoint Privilege Management) but could really do with knowing if the rest of the features are coming. Can't seem to find any information online about it.problem with Auto-Enrollment for windows devices in Hybrid enviroument
Hi everyone, I am in the process of setting up Intune for automatic enrollment on Windows devices within our hybrid environment. Here are the steps I have taken so far: 1. Configured Entra ID sync to synchronize a selected OU with Entra ID. 2. In the Intune Portal, set the Automatic enrollment MDM user scope to "All." 3. Created a GPO linked to that OU, which includes the settings to "register domain-joined computers as devices" and "Enabled automatic MDM enrollment using default Azure credentials" based on User Credential. 4. Prepared a clean computer, free of any software, and joined it to the Domain (on-prem server). 5. Moved the computer to the appropriate OU for syncing with Entra ID. 6. At this point, I can see the computer listed in the Entra ID portal under devices as Entra Hybrid joined 7. A regular domain user with a Business Premium license logged into the computer.( Only sign-in to windows, we don't have office app or add this account to windows.) 8. I ran GPupdate /force and rebooted the computer several times, but it still does not appear in the Intune portal. 9.Windows client is windows 11 Pro version 25H2 OS build 26200.8893 Dsregcmd output shows: ✅ Device is domain joined ✅ Device is synced to Entra ID ✅ Device authentication is working ✅ User has a valid PRT (Primary Refresh Token) ✅ Hybrid Join is successful On second test computer2, I installed office desktop app, then sign-in with test user to activate it. After few minutes the computer appeared on Intune portal. but on test computer 1 without user's interaction, it doesn't show up. would you be able to help me with this? Does it really need user to attach his/her account manually to "work or school account" or sing-in to any office desktop apps?Compliance Policies - Device Health Attestation failing (Syncml 404 / 0x87d10194)
Windows 11 devices are non compliant in Intune against BitLocker, Secure Boot and Code Integrity, all three returning the Syncml 404 error. The settings are genuinely enabled. The real cause is the device can't retrieve a Device Health Attestation certificate, so the health cert status sits at 65535 and the retrieval task fails. What I've found: the TPM is healthy (present, ready, attestation capable, firmware not vulnerable), and the endorsement key cert is valid, chaining to Nuvoton TPM Root CA 2111. But the EK chain check comes back invalid with zero intermediate certificates, because the Nuvoton key is signed straight off the root with no intermediate for the chain walk. A Hyper-V VM on the same build and tenant works fine, but only because it has no manufacturer EK cert, so it skips that chain check entirely. What I've tried: patching TPM firmware (ruled out the older ADV190024 issue), refreshing the local trusted TPM certificate store, and rerunning the retrieval task. None fixed it. This matches Rudy Ooms' well known call4cloud writeup, where he concluded it's a service side trust problem that can't be fixed from the device. It's now appearing on brand new Dell hardware too, so I can't just exclude the old kit and move on. Is this a known issue with the Nuvoton root chain, and is there a supported fix or position from Microsoft? Screenshots below showing the compliance errors and the failure.
iOS Enrollment and Conditional Access
Hello everyone, I need some help! We are configuring Intune to allow BYOD on iOS devices using the Account Driven User Enrollment method. In this scenario, the user enrolls the device by following the path: Settings > General > VPN & Device Management > Sign in to your Work or School Account The enrollment process was working correctly until we configured a Conditional Access policy to ensure that only BYOD-managed devices can access company resources. In other words, only devices that have successfully completed enrollment and are marked as Compliant in Intune should be allowed to use corporate applications. However, after applying the policy, we are no longer able to complete the enrollment process. During one of the enrollment steps, the device displays the following message: Translate English "Setting Up iPhone iPhone setup may take a few minutes. Sign-In Failed Enrollment failed. Please try again. OK" 1. Target resources (Include) 2. Target resources (Exclude) 3. Device Platform: iOS 4. Filter for devices: device.mdmAppId -notIn ["0000000a-0000-0000-c000-000000000000"] 5. Grant: Require device to be marked as compliant This is our current Conditional Access policy configuration. Has anyone encountered this behavior before, or can identify whether there is any setting that might be blocking the enrollment process during the compliance validation stage?
