Autopilot & Enrollmentdecimal -2145910741
Fix Intune Error 0x8018002B: Group Policy based automatic MDM enrollment failed, normally because the UPN is non-routable or the MDM user scope is None.
Open the log below first. It is the quickest way to confirm which of the causes applies before you change anything.
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx
Folder: C:\Windows\System32\winevt\Logs\
Root causes
- The user UPN uses an unverified or non-routable suffix such as .local (joe@contoso.local).
- MDM user scope is set to None, so the user is not in scope for automatic enrollment.
- The device has no valid Entra ID join or primary refresh token, so the enrollment task cannot authenticate.
Step-by-step remediation
- Open Task Scheduler > Microsoft > Windows > EnterpriseMgmt and check the last run result of the automatic enrollment task.
- Look for event 76 in the DeviceManagement-Enterprise-Diagnostics-Provider Admin log.
- Give affected users a verified, routable UPN suffix in Active Directory Users and Computers.
- Check Entra ID > Mobility (MDM and MAM) > Microsoft Intune and set MDM user scope to Some or All, including the affected users.
- Run dsregcmd /status. If AzureAdPrt is NO, sign out and back in, then run gpupdate /force and retry.
For the full diagnosis around this error, read Company Portal enrolment stuck.
Tighten the rollout around it
Enrollment and compliance errors usually trace back to rollout design and device permissions. See how the endpoint privilege management tools compare, and plan the next ring with a tested runbook.
Compare Intune endpoint privilege management toolsRelated Error Codes in This Category
Other Autopilot & Enrollment errors with their own runbooks.
- 0x80180014The MDM service refused enrollment: Windows (MDM) is blocked by an enrollment restriction, or the reused Autopilot device record is blocked.
- 0x80180013The user has reached the Intune device limit (15 by default), so enrollment of another device is refused.
- 0x80180026MDM enrollment was blocked because another management agent is present: automatic MDM enrollment collides with the legacy Intune PC client.
- 0x800705B4A timeout (ERROR_TIMEOUT). In Autopilot it is typically TPM 2.0 attestation failing during self-deploying mode, or the ESP device phase timing out.
- 0x801C03EATPM attestation failed, so the device could not get a device token and failed to join Microsoft Entra ID.