Apple enrollment in Intune fails in four places: the Company Portal app, the profile installation screen in Settings, Setup Assistant on an Automated Device Enrollment (ADE) device, or the token pages in the Intune admin center. Here are the iPhone, iPad and Mac errors Microsoft documents, with the meaning, usual cause and first check for each.
Codes in this quick reference
NoEnrollmentPolicy: No enrollment policy found (APNs certificate missing, invalid or expired)Company Portal (iOS/iPadOS)DeviceCapReached: Too many mobile devices are enrolled alreadyCompany Portal (iOS/iPadOS)Company Portal Temporarily Unavailable: app out of date or corrupted, or the device limit was reachedCompany Portal (iOS/iPadOS)APNSCertificateNotValid: problem with the certificate that lets the device talk to your company's networkCompany Portal (iOS/iPadOS)AccountNotOnboarded: Apple MDM push (APNs) certificate not set up or expired (iOS/iPadOS)Company Portal (iOS/iPadOS)DeviceTypeNotSupported: the device type you're trying to enroll isn't supportedCompany Portal (iOS/iPadOS)UserLicenseTypeInvalid: user not in a required group or missing the correct licenceCompany Portal (iOS/iPadOS)MdmAuthorityNotDefined: the mobile device management authority hasn't been definedCompany Portal
+ 28 more codes in the tables below.
How to read these errors#
Where the error appears tells you which part of the chain broke:
- Company Portal (iPhone, iPad or Mac): codes such as
DeviceCapReachedor a plain-language equivalent. They reflect Intune's checks on the user and tenant (licence, MDM authority, device limit, push certificate), so the fix is usually in the admin center. - Settings on the iPhone or iPad:
Profile Installation Failedmeans iOS/iPadOS rejected the management profile. Start on the device. - Setup Assistant (ADE): an error, no remote management screen, or a stop after sign-in. Start with the enrollment program token and the profile assigned to the serial number.
- Intune admin center: token errors show under Devices › Device onboarding › Enrollment, Apple tab, Enrollment program tokens. The Apple MDM push certificate is on the same tab, and Tenant administration › Tenant status › Connector status shows its health.
Ask the user for the exact text and a screenshot: the Company Portal often shows a generic message while its logs hold the specific code. Then open the user in Troubleshooting + support › Troubleshoot to see licence, devices and enrollment failures together. Personal iPhones on account-driven User Enrollment follow a different flow (setup guide).
iPhone and iPad enrollment errors#
Sources: Microsoft Learn's iOS/iPadOS enrollment errors and general enrollment troubleshooting pages. The licence, MDM authority and device-limit rows apply to Macs too.
Company Portal codes and messages#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
NoEnrollmentPolicy | No enrollment policy found | Missing, invalid or expired Apple MDM push (APNs) certificate | Push certificate status; iOS/iPadOS enrollment set up and allowed |
DeviceCapReached | Too many mobile devices are enrolled already | User at the device limit (stale records count too) | Device limit restriction vs Users › All users › user › Devices; delete stale devices |
Company Portal Temporarily Unavailable | Generic Company Portal failure | App out of date or corrupted; can also hide a device cap | Reinstall; test sign-in at https://portal.manage.microsoft.com in Safari; check the device limit |
APNSCertificateNotValid | There's a problem with the certificate that lets the mobile device communicate with your company's network | Push certificate never completed, or expired | Renew (don't replace) the push certificate; re-enroll |
AccountNotOnboarded | Same certificate message | APNs setup incomplete or expired | As above (on Jamf-managed Macs it means something else) |
DeviceTypeNotSupported | The device type you're trying to enroll isn't supported | Not an iOS/iPadOS device, or an unsupported OS version | Device model and OS version |
UserLicenseTypeInvalid | The user isn't in a required group or doesn't have the correct licence | No Intune licence, or the wrong type for the MDM authority | Assign an Intune licence |
MdmAuthorityNotDefined, MDM authority not defined | The mobile device management authority hasn't been defined | Authority not set, or the user's account didn't sync correctly | Tenant administration › Tenant status; the user's UPN in Microsoft Entra ID |
Looks like your IT admin hasn't set an MDM authority. Get help from your IT admin or try again later. | The same problem, as users see it | MDM authority not set | As above |
Your IT admin hasn't given you access to use this app. Get help from your IT admin or try again later. | User can't use Intune | Missing licence, or the wrong licence type | Assign the licence, then retry |
User Name Not Recognized. This user account isn't authorized to use Microsoft Intune. Contact your system administrator if you think you have received this message in error. | No valid Intune licence | Licence missing | The user's licences in the Microsoft 365 admin center, then re-enroll |
Workplace Join failed | Company Portal couldn't register the device | App out of date or corrupted | Remove the app, reinstall it from the App Store, re-enroll |
The configuration for your iPhone/iPad couldn't be downloaded from <Company Name>: Invalid Profile | Enrollment blocked by policy | A device platform (type) restriction blocks iOS/iPadOS enrollment | Allow iOS/iPadOS in the All Users platform restriction; to keep personal devices out, block personally owned devices rather than the platform |
Profile Installation Failed messages#
Shown in Settings while the management profile installs (source: Microsoft Learn's profile installation failed page).
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Profile installation failed (no detail) | The management profile didn't install | No licence, another MDM, an existing management profile, or Safari not default / cookies off | Those four, in that order |
Profile Installation Failed. A Network Error Has Occurred. | An unspecified problem with iOS/iPadOS on the device | Despite the wording, the OS, not the network | Back up, restore from recovery mode as a new device, re-enroll |
Profile Installation Failed. Connection to the server could not be established. | The device couldn't complete enrollment with Intune | Microsoft lists four: personal devices blocked by an enrollment restriction, a previous user not removed from Intune, another MDM's management profile, or no Intune licence | Restrictions and licence; remove other management profiles; retry from https://portal.manage.microsoft.com in Safari, clearing (not blocking) cookies if it still fails |
Profile Installation Failed. The new MDM payload does not match the old payload. | A management profile is already installed | Leftover profile from an earlier enrollment or another MDM | Settings › General › VPN & Device Management, tap the profile, Remove Management, re-enroll |
Note: An expired-looking IOSProfileSigning.manage.microsoft.com certificate in the management profile is expected: iOS/iPadOS keeps it after enrollment by design, and it doesn't affect enrolled devices.
Automated Device Enrollment (ADE) errors#
Token sync errors in the Intune admin center#
Shown on the enrollment program token. Renewal, sync limits and default profiles: Apple ADE devices missing in Intune.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Expired or invalid token | Intune can't use the token | Token expired, revoked or malformed | Renew it; if that fails, support may have you upload a new public key in Apple |
Access denied | Intune can no longer talk to Apple | Intune removed from the MDM server list in Apple, or the token expired | Does the MDM server still exist? Was a newer token downloaded? |
Terms and conditions not accepted | Apple is waiting for new terms | New T&C in Apple Business (formerly Apple Business Manager) or Apple School Manager | A user with the Administrator role there accepts them |
Internal server error | Needs investigation | Not documented | Open a support case; Microsoft needs more logs |
Invalid support phone number | Enrollment profile rejected | Invalid support phone number in the profile | Edit the phone number in your enrollment profiles |
Invalid configuration profile name | Enrollment profile rejected | Name invalid, empty or too long | Rename the profile |
Invalid department entry | Enrollment profile rejected | Department field invalid | Edit the department field |
Apple profile not found | No matching profile at Apple | Several possible causes | Create a new enrollment profile and assign it to the devices |
Invalid cursor | Sync cursor rejected by Apple or not found | Service-side sync state | Intune support can retry the sync |
Cursor expired | Sync cursor expired on Intune's side | Service-side sync state | Intune support can retry the sync |
Required cursor | Intune never set the cursor during sync | Service-side sync state | Intune support fixes the sync |
An error occurred while uploading the Enrollment Program token. | Token upload failed, often with Request ID: AjaxError: ajaxExtended call failed | Not documented; the fix re-keys the MDM server | The Graph workaround below |
Microsoft's workaround for the upload error, run in Graph Explorer as an Intune administrator:
Text
GET https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings
GET https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings/<TokenGuid>/getEncryptionPublicKeySave the returned value as a three-line .pem file (BEGIN line, base64 string without line breaks, END line). In Apple Business or Apple School Manager, edit the MDM server, upload the .pem, save, select Download Token, and upload it to the existing token in Intune.
ADE errors on the device#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
XPC_TYPE_ERROR Connection invalid (device log) | ADE enrollment fails at power-on | Connection problem between the device and Apple's ADE service | Fix the network or try a different one; contact Apple if it persists |
When there is no error message#
- Remote management never starts: the profile was created before the token was uploaded, or none is assigned (Microsoft Learn). Assign one or make any small edit to it, sync the token, then turn the device on.
- Setup Assistant stops after sign-in: MFA with the Setup Assistant (legacy) method. Switch to Setup Assistant with modern authentication.
- ADE with user affinity fails with AD FS: the WS-Trust 1.3 Username/Mixed endpoint must be enabled:
Get-AdfsEndpoint -AddressPath "/adfs/services/trust/13/UsernameMixed". - Government users sent to the public cloud when signing in from another device: set Settings › Company Portal › Cloud to Government.
Apple MDM push certificate (APNs)#
Every iOS/iPadOS and macOS enrollment depends on this tenant-wide certificate, so a lapsed one surfaces as NoEnrollmentPolicy, APNSCertificateNotValid or AccountNotOnboarded. What Microsoft documents:
- Valid for 365 days; renew every year. After expiry there's a 30-day grace period.
- Renew with the same Apple account: Devices › Device onboarding › Enrollment, Apple tab, Apple MDM Push Certificate, download the CSR, then choose Renew on the existing certificate in the Apple Push Certificates Portal.
- Never create a new certificate instead: replacing it means re-enrolling every iOS/iPadOS device.
- Moving to Managed Apple Accounts? Ask Apple to migrate the existing certificate (federation guide).
Tip: To renew the right certificate, check an enrolled iPhone: the management profile's details (Settings › General › VPN & Device Management) include a Topic value whose GUID matches the certificate's UID in Apple's portal. Renewal walk-through: Macs unexpectedly unenrolled from Intune.
Mac enrollment errors#
Sources: Microsoft Learn's macOS virtual machine enrollment and keychain error -25244 pages, plus its Jamf registration errors page.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
It looks like you're using a virtual machine. Make sure you've fully configured your virtual machine, including serial number and hardware model. If this isn't a virtual machine, please contact support. | Intune can't identify the Mac | Test VM without a serial number and hardware model | Set both in the VM, then re-enroll |
We're having trouble getting your device managed. This problem could be caused if you're using a virtual machine, have a restricted serial number, or if this device is already assigned to someone else. | Enrollment refused | Misconfigured VM, personal Macs blocked, or a stale record assigned to another user | Add the serial number as a corporate device identifier, or delete the old records in Devices › All devices |
Your Mac cannot be enrolled at this time | Company Portal enrollment failed | One documented cause: stale keychain entries (next row) | Search the Company Portal logs for -25244 |
error code:-25244 (errSecInvalidOwnerEdit) | Company Portal couldn't delete old workplace join items from the keychain | Stale or corrupted Intune-related keychain entries | As local admin, delete the workplace and listed Microsoft items in Keychain Access; re-enroll |
Account not onboarded (Jamf-managed Mac) | Registration ran without its link to Jamf | Company Portal opened directly instead of from Jamf Self Service | Relaunch Company Portal from Self Service |
Device is already enrolled (Jamf-managed Mac) | Duplicate or failed registration | An old Intune record left after unenrolling, or repeated attempts | Remove the old record, then register again |
How to verify a fix#
- iPhone or iPad: the management profile shows under Settings › General › VPN & Device Management and the device appears in Devices › By platform › iOS/iPadOS with a recent check-in. For ADE, the serial number is in the token's device list with a profile assigned.
- Mac:
profiles status -type enrollmentreports MDM enrollment as Yes (User Approved); ADE Macs also report Enrolled via DEP: Yes. - Push certificate: active in both the admin center and the Apple Push Certificates Portal.
- Tokens: no error and a recent successful sync.
PowerShell
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"
# Push certificate: Apple ID, topic, expiry
Invoke-MgGraphRequest -Method GET -OutputType PSObject -Uri "https://graph.microsoft.com/beta/deviceManagement/applePushNotificationCertificate" |
Select-Object appleIdentifier, topicIdentifier, expirationDateTime
# ADE tokens: expiry and last successful sync
(Invoke-MgGraphRequest -Method GET -OutputType PSObject -Uri "https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings").value |
Select-Object tokenName, tokenExpirationDateTime, lastSuccessfulSyncDateTimeEnrolled, but apps or settings fail? Switch to the app install error codes (plus VPP tokens), profile and compliance codes or, for sign-in blocks, AADSTS errors.
References#
- Troubleshooting iOS/iPadOS device enrollment errors in Microsoft Intune (Microsoft Learn)
- Troubleshooting profile installation failed error on iOS or iPadOS devices (Microsoft Learn)
- Troubleshoot device enrollment in Intune (Microsoft Learn): general checks, device cap and the expired IOSProfileSigning certificate
- Get an Apple MDM push certificate (Microsoft Learn)
