Autopilot & Enrollmentdecimal -2145647638
Fix Intune Error 0x801C03EA: TPM attestation failed, so the device could not get a device token and failed to join Microsoft Entra ID.
Open the log below first. It is the quickest way to confirm which of the causes applies before you change anything.
Microsoft-Windows-User Device Registration%4Admin.evtx
Folder: C:\Windows\System32\winevt\Logs\
Also check: Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Autopilot.evtx
Root causes
- The endorsement key (EK) certificate cannot be retrieved or validated, often because the TPM vendor URL that serves it is blocked.
- The TPM is virtual, disabled, in a failed state or a version that does not support attestation.
- Firmware with a known attestation bug, for example Intel firmware TPM on Tiger Lake needing the November 2021 cumulative update or later.
- Proxy or TLS inspection breaks the attestation request.
Step-by-step remediation
- On the device run Get-Tpm, then Get-TpmEndorsementKeyInfo -HashAlgorithm sha256 and confirm an EK certificate is present.
- Check the User Device Registration Admin log for the exact attestation failure that precedes the error.
- Open the TPM vendor attestation and certificate URLs to the device, bypassing TLS inspection and authentication on the proxy.
- Install the latest OEM BIOS, TPM firmware and Windows cumulative update.
- If the TPM is in a failed state, clear it from firmware setup. Back up the BitLocker recovery key first, because clearing destroys TPM-held keys.
- Delete the device record in Intune and Entra ID, then reset and retry.
For the full diagnosis around this error, read Windows Autopilot Enrollment Status Page Stuck at 0% — Causes and Fixes.
Tighten the rollout around it
Enrollment and compliance errors usually trace back to rollout design and device permissions. See how the endpoint privilege management tools compare, and plan the next ring with a tested runbook.
Compare Intune endpoint privilege management toolsRelated Error Codes in This Category
Other Autopilot & Enrollment errors with their own runbooks.
- 0x80180014The MDM service refused enrollment: Windows (MDM) is blocked by an enrollment restriction, or the reused Autopilot device record is blocked.
- 0x80180013The user has reached the Intune device limit (15 by default), so enrollment of another device is refused.
- 0x80180026MDM enrollment was blocked because another management agent is present: automatic MDM enrollment collides with the legacy Intune PC client.
- 0x8018002BGroup Policy based automatic MDM enrollment failed, normally because the UPN is non-routable or the MDM user scope is None.
- 0x800705B4A timeout (ERROR_TIMEOUT). In Autopilot it is typically TPM 2.0 attestation failing during self-deploying mode, or the ESP device phase timing out.