Windows enrollment error 0x80180018 and its neighbours: what to check, and where

A user joins a Windows device to Microsoft Entra ID or adds a work account, and instead of landing in Intune the device stops with "Something went wrong" and a code such as 80180018. The codes in the 0x8018xxxx range all come from the MDM enrollment client, and Microsoft publishes what each one means. In this post I'll map the common ones to the tenant setting that usually causes them, show where to check each setting, and explain how to confirm the fix from the device's enrollment log.

Symptoms#

• During OOBE, or in Settings › Accounts › Access work or school, enrollment stops with a dialog that ends in "contact your system administrator with the error code 80180018" (the dialog usually drops the 0x prefix).
• The on-screen wording varies. You may see "This user isn't authorized to enroll" or "There was an error with your license". Microsoft's reference table ties 0x80180018 itself to the user's licence state, so work from the code, not the sentence.
• The Entra join part often succeeds: the device appears in Entra ID, but it never shows up under Devices › Windows in the Intune admin center.
• For Group Policy auto-enrollment there's no dialog at all. Instead the DeviceManagement-Enterprise-Diagnostics-Provider › Admin event log records event 76, "Auto MDM Enroll: Failed", with the code in the message.

Why it happens#

Windows reports a specific MENROLL_E_* value for each enrollment failure, and Microsoft documents them in the Windows client management reference. The table below lists the ones I see most, what Microsoft says they mean, and where in the tenant the cause normally lives.

Two licence-related messages don't come with a code. "This account is not allowed on this phone" means the user has no valid Intune licence. "Looks like the MDM Terms of Use endpoint is not correctly configured" appears when a tenant uses both basic mobility for Microsoft 365 and Intune and the user has no valid licence, or when the MDM terms of use URL in the Mobility settings is blank or wrong.

How to fix it#

1. Get the exact code from the device. If the dialog is gone, open Event Viewer and go to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin. Event 75 is a successful automatic enrollment; event 76 is a failed one and carries the code. To collect everything for later, run:
   Command Prompt

   mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning -cab C:\enrollment.cab

2. 0x80180018: fix the licence. In the Intune admin center open Users › All users, select the user and review Licenses (or use the Microsoft 365 admin center). The user needs a licence that includes Intune, and the Microsoft Intune service plan inside that licence must be turned on, not just the parent SKU. If the user was licensed a moment ago, give the change a few minutes before retrying. If you deliberately don't license some users and only want them Entra joined, keep them out of the MDM user scope so Windows doesn't attempt enrollment for them.
3. 0x80180013 and 0x801c000E: check both device limits. Intune's limit lives at Devices › Device onboarding › Enrollment › Device limit restrictions and can be set from 1 to 15; it applies to user-driven enrollments only. Compare it with the count under Users › All users › the user › Devices and retire or delete records the user no longer uses. Entra joined, Autopilot, Group Policy, co-management, bulk and device enrollment manager enrollments aren't subject to the Intune limit; for those the cap is Maximum number of devices in the Entra admin center under Entra ID › Devices › Device settings (default 50, up to 100, or Unlimited; it doesn't apply to hybrid joined devices).
4. 0x8018000A: remove the other connection. Sign in to Windows as the account that originally enrolled or joined the device, remove its connection in Settings › Accounts › Access work or school, sign back in as the intended user and enroll again.
5. 0x80180014: allow Windows (MDM). Under Devices › Device onboarding › Enrollment › Device platform restriction, confirm that every restriction that can apply to the user allows Windows (MDM), including the default one.
6. 0x8018002b and 0x80180003: check automatic enrollment and the UPN. Go to Devices › Device onboarding › Enrollment › Windows › Automatic Enrollment. Set MDM user scope to All, or Some with a group that contains the user, keep the three MDM URLs at their defaults and don't put the same users in the MAM (WIP) scope, because for personal devices the MAM scope wins. Automatic enrollment needs Microsoft Entra ID P1 or P2. If the tenant shows both Microsoft Intune and Microsoft Intune Enrollment under Mobility, the settings must be on Microsoft Intune. For hybrid joined devices, the user's UPN must use a verified, routable domain: a .local suffix fails, so fix the UPN suffix in Active Directory and run a delta sync.
7. Retry. On a hybrid joined device, run gpupdate /force or start the task Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID under Microsoft › Windows › EnterpriseMgmt in Task Scheduler; it otherwise retries every 5 minutes for a day. For OOBE, restart the flow after the tenant change has had time to apply.

Verify the fix#

• The DeviceManagement-Enterprise-Diagnostics-Provider › Admin log shows event 75 for the user, and no new event 76.
• dsregcmd /status on the device reports AzureAdJoined : YES and a populated MdmUrl pointing at enrollment.manage.microsoft.com.
• The device appears under Devices › Windows with a current last check-in, and the Entra device record shows Microsoft Intune in the MDM column.

Prevent it next time#

• Use group-based licensing and make the same group the Some scope for automatic enrollment, so a user is never in scope without a licence.
• Size device limits for how people actually work, and retire old records when hardware is replaced instead of raising the limit.
• Keep the default enrollment restrictions permissive for Windows (MDM) and apply blocks through targeted, higher-priority restrictions.
• Fix non-routable UPN suffixes before you enable Group Policy auto-enrollment, not after the first failure.

References#

• Troubleshooting Windows device enrollment errors in Intune
• Diagnose MDM enrollment failures (error code reference)
• Overview of enrollment restrictions in Microsoft Intune