Windows Autopilot & Intune Enrollment Errors: Practical Troubleshooting Guide
Fix the failure without guessing
When an Autopilot build fails, the message on the Enrollment Status Page is only the starting point. The useful evidence normally sits in Intune deployment reports, the device event logs, MDM diagnostics, and the app installation status.
This guide gives IT administrators a repeatable workflow: record the exact error, identify the failed phase, collect evidence, correct the assignment or device state, and test again.
Identify the failed phase
Start by deciding whether the failure happened before enrollment, during device setup, or during account setup. This immediately narrows the investigation.
- Before the organisation sign-in page: check network access, device registration, profile assignment, Windows edition, and Autopilot registration.
- Device preparation or device setup: check MDM enrollment, security policies, certificates, scripts, and device-context applications.
- Account setup: check user-targeted policies, user-context applications, licensing, and enrollment restrictions.
Check the error code first
| Error or symptom | Likely area | First check |
|---|---|---|
0x80180022 | Unsupported Windows edition | Confirm the device runs Windows Pro, Enterprise, or Education rather than Home. |
0x8018000a | Existing enrollment | Check for another connected work or school account and an existing device record. |
0x80180014 | Enrollment restriction or reused device | Review Windows enrollment restrictions and whether the device must be unblocked for reuse. |
0x800705b4 | Timeout or TPM requirement | Confirm the failed phase, TPM 2.0 state, connectivity, and whether an app or policy timed out. |
OOBEIDPS | Identity provider connectivity | Check proxy, firewall, DNS, and required Microsoft service endpoints. |
| Apps failed or timed out | Application deployment | Find the failed app in Intune and review its install context, detection rule, dependencies, and return code. |
Use the code as a search key, but always match it to the failed phase and logs. The same timeout code can appear in more than one scenario. Microsoft maintains a current Windows enrollment error reference.
Review the deployment in Intune
Open the Intune admin center and locate the device preparation or Autopilot deployment report. Match the device using its serial number, then compare the deployment timestamp with the user's reported failure.
- Open Devices and the relevant Windows enrollment or Autopilot report.
- Locate the device and confirm the correct deployment profile and group assignment.
- Review the failed stage, application status, policy status, and last check-in time.
- Check whether the user has the required Intune and Microsoft Entra licensing.
- Confirm the device and user are not receiving conflicting assignments.
Collect evidence from the device
When the portal does not explain the failure, collect MDM diagnostics and inspect the device-management event log.
# Run from an elevated Command Prompt or PowerShell window
mdmdiagnosticstool.exe -area Autopilot;DeviceEnrollment;DeviceProvisioning -cab C:\Temp\AutopilotLogs.cabIn Event Viewer, review:
Applications and Services Logs
Microsoft
Windows
DeviceManagement-Enterprise-Diagnostics-Provider
AdminFilter around the failure time and save the relevant events. Also review Autopilot, provisioning, and app-management evidence included in the diagnostics package.
Diagnose app installation failures
If ESP or device preparation stops at applications, identify the exact app before changing the enrollment profile.
- Confirm whether the app installs in System or User context.
- Validate the detection rule on a clean test device.
- Review dependencies, supersedence, requirement rules, and restart behaviour.
- Check whether multiple installers are competing or a previous installation is still in progress.
- Test the install and uninstall commands outside Autopilot using the same security context.
Validate registration, groups, and restrictions
- Confirm the serial number and hardware hash belong to the physical device being tested.
- Check the assigned Autopilot or device preparation profile.
- Review dynamic group processing and confirm membership has completed.
- Check Windows platform enrollment restrictions and device limits.
- Confirm the user is in the intended MDM user scope and has a valid license.
- For device preparation, validate the device group and required service-principal ownership described in your deployment design.
Retest safely
After correcting the identified cause, allow time for the assignment to update, verify the device's intended state in Intune, and then retest with a documented reset or redeployment method.
- Record the change you made and the original failure.
- Confirm the corrected group, policy, profile, or app assignment.
- Use a supported reset or redeployment method for the scenario.
- Record the new deployment time and result.
- If it fails again, compare the new evidence with the original rather than starting from scratch.
Autopilot incident checklist
- Exact error code and failure stage captured
- Serial number, user, timestamp, and Windows edition verified
- Profile, group membership, license, MDM scope, and restrictions checked
- Intune deployment and app status reviewed
- MDM diagnostics and Event Viewer evidence collected
- Only the identified cause changed
- Retest result documented