Troubleshooting playbook¶

Most Intune problems fall into a handful of patterns. This playbook gives you a method and a runbook for each pattern. For where to find logs on each platform, see Logs and diagnostics.

The method¶

flowchart LR
    A[1. Scope it] --> B[2. Check what changed]
    B --> C[3. Check the device's view]
    C --> D[4. Check targeting]
    D --> E[5. Read the client logs]
    E --> F[6. Reproduce]
    F --> G[7. Escalate with evidence]

1. Scope it. One user or many? One platform, model, location or OS version? Since when? A problem that affects everyone at once usually means a service issue or a recent change. A problem on one device usually means that device.
2. Check what changed. Look at Tenant administration > Tenant status for service incidents, and Audit logs for changes around the time the problem started.
3. Check the device's view. Open the device in the admin center: last check-in, compliance, device configuration status, app status. Run Sync and wait a few minutes.
4. Check targeting. Is the user or device actually in the groups you think? What does the device's Filter evaluation say? Is there an exclusion?
5. Read the client logs. The portal tells you that something failed. The device tells you why.
6. Reproduce on a test device in the same groups. If you can't reproduce it, compare the two devices.
7. Escalate with evidence: tenant ID, device ID, UPN, exact times in UTC, what you've checked, and logs.

Policy or setting not applying¶

1. Check the device's Device configuration page. Is the profile listed? What's its state?
2. Not listed: the device isn't targeted. Check groups, filter evaluation and exclusions.
3. Pending: the device hasn't checked in since the assignment. Sync it. If it never checks in, see Device not checking in.
4. Error: open the profile's per-setting status for the error code, then check the device logs (on Windows, the DeviceManagement-Enterprise-Diagnostics-Provider event log).
5. Conflict: another profile sets the same setting differently. Decide which profile owns it.
6. Not applicable: the setting isn't supported on that Windows edition or OS version, or needs supervision on Apple devices.
7. Succeeded, but the device doesn't behave: something else is overriding it, such as Group Policy on hybrid devices, a local setting, or the app ignoring the setting. On Windows, check HKLM\SOFTWARE\Microsoft\PolicyManager\current\device to see what MDM actually applied.

App not installing¶

Device is noncompliant¶

1. Open the device's Device compliance page and the failing policy to see the exact setting.
2. Common causes:
   • BitLocker, Secure Boot or code integrity on Windows: these come from device health attestation, which updates at boot. Restart the device after fixing.
   • OS version: the device is behind on updates.
   • Defender risk score: the device has an active threat in Defender for Endpoint.
   • Is active / validity period: the device hasn't reported in the configured number of days.
   • No compliance policy assigned: with the tenant setting at Not compliant, unassigned devices fail.
3. After the user fixes the issue, have them open Company Portal and select Check status to trigger a fresh evaluation.

User blocked by Conditional Access¶

1. Find the sign-in in the Entra admin center Sign-in logs. The Conditional Access tab shows which policy blocked it and which grant failed.
2. Check the Device info tab. If the device ID is blank, the device wasn't identified: usually a browser issue (Chrome without the SSO extension, a private window, Edge not signed in). See Conditional Access.
3. If the device was identified, check its compliance state in Intune and in Entra ID. They can briefly disagree after a change.
4. For mobile apps blocked by an app protection requirement, check that the app supports app protection and is in the user's policy.

Enrollment fails¶

Devices > Monitor > Enrollment failures shows the failure reason for each attempt.

Device not checking in¶

1. Check Last check-in on the device page.
2. Ask the user to sync from Company Portal (or Settings > Accounts > Access work or school > Info > Sync on Windows).
3. Check network access to the Intune and push notification endpoints. See Network requirements. TLS inspection breaking the connection is a frequent cause.
4. Check the device clock. Large time differences break authentication.
5. On Windows, if dsregcmd /status shows the device isn't joined anymore, or the TPM was reset, the device has to re-enroll.
6. If the management certificate expired (the device has been offline for many months), the device must re-enroll.

Every Apple device stopped responding¶

Almost always the Apple MDM push certificate. Check its status under Devices > Enrollment > Apple. Renew it with the same Apple account. If it was replaced with a new certificate instead of renewed, every device must re-enroll. See Apple devices.

Remote action stuck at "Pending"¶

• The device is offline, or can't receive push notifications.
• A retire, wipe or delete is also pending. Those take precedence and other actions are dropped.
• You've hit a daily tenant limit (500 wipes, 1,000 retires or 1,000 deletes).

Getting help from Microsoft¶

Open a case from Troubleshooting + support > Help and support. Include the tenant ID, affected UPNs and device IDs, exact UTC times, what you've already ruled out, and logs (an MDM diagnostic report on Windows, or the Company Portal log upload incident ID on mobile).

Learn more¶

• Troubleshooting device enrollment
• Troubleshoot Conditional Access
• Troubleshoot app protection policy deployment