Troubleshooting iOS/iPadOS device enrollment errors in Microsoft Intune

This article helps Intune administrators understand and troubleshoot problems when enrolling iOS/iPadOS devices in Intune. See Troubleshoot device enrollment in Microsoft Intune for additional, general troubleshooting scenarios.

iOS/iPadOS enrollment errors

The following table lists errors that end users might see while enrolling iOS/iPadOS devices in Intune.

Sync token errors between Intune and ADE

This section includes token sync errors related to Apple Automated Device Enrollment (ADE):

• Apple Business Manager (ABM)
• Apple School Manager (ASM)

Error: An error occurred while uploading the Enrollment Program token

If the ADE token upload fails, you might see an error message that resembles the following:

An error occurred.
An error occurred while uploading the Enrollment Program token. Request ID: AjaxError: ajaxExtended call failed

In this case, try the following steps to create a new token:

1. Sign in to Graph Explorer as an Intune administrator.

2. Run a GET request to enumerate the tokens in the tenant by using the following URL:

   https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings

   If necessary, grant consent and rerun the request.

3. Find the GUID of the token that needs to be renewed.

4. Run a GET request to get the public encryption key of the token by using the following URL:

   https://graph.microsoft.com/beta/deviceManagement/depOnboardingSettings/<TokenGuid>/getEncryptionPublicKey

   The response looks like the following example:

   {
   "@odata.context": "https://graph.microsoft.com/beta/$metadata#Edm.String",
   "value": "-----BEGIN CERTIFICATE-----SOMEBASE64STRING==-----END CERTIFICATE-----"
   }
   

5. Copy the value from the response and create a text file as follows. Then, save the text file as a .pem file. For example, token.pem.

   Important

   The file contains three lines, and there are no link breaks in the base64 string.

   -----BEGIN CERTIFICATE-----
   SOMEBASE64STRING==
   -----END CERTIFICATE-----
   

6. Sign in to Apple Business Manager or Apple School Manager and find the token server that needs to be updated. Then, select Edit.

7. In the MDM Server Settings section, upload the .pem file, and then select Save.

   Note

   If you receive an error message indicating the file format is incorrect, make sure that the file is created according to step 5. After the file format is fixed, close the page and select Edit again.

8. Select Download Token to download the new token.

9. Sign in to Intune and select to refresh the downloaded token.

Other errors and issues

This section provides troubleshooting steps for these additional scenarios:

• Verify WS-Trust 1.3 is enabled
• Workplace Join failed
• User Name Not Recognized
• XPC_TYPE_ERROR Connection invalid
• The configuration could not be downloaded...Invalid Profile
• ADE enrollment doesn't start
• ADE enrollment stuck at user login
• Authentication doesn't redirect to the government cloud

Verify WS-Trust 1.3 is enabled

Enrolling ADE devices with user affinity requires WS-Trust 1.3 Username/Mixed endpoint to be enabled to request user tokens. Active Directory enables this endpoint by default. If WS-Trust 1.3 is not enabled, Automated Device Enrollment (ADE) iOS/iPadOS devices can't be enrolled.

To get a list of enabled endpoints, use the Get-AdfsEndpoint PowerShell cmdlet and looking for the trust/13/UsernameMixed endpoint. For example:

Get-AdfsEndpoint -AddressPath "/adfs/services/trust/13/UsernameMixed"

For more information, see Get-AdfsEndpoint documentation and Best practices for securing Active Directory Federation Services. For help with determining if WS-Trust 1.3 Username/Mixed is enabled in your identity federation provider, contact Microsoft Support if you use AD FS. Otherwise, contact your third-party identity vendor.

Workplace Join failed

This error indicates that the Company Portal app is out of date or corrupted.

Solution:

1. Remove the Company Portal app from the device.
2. Download and install the Microsoft Intune Company Portal app from App Store.
3. Re-enroll the device.

User Name Not Recognized

The error "User Name Not Recognized. This user account is not authorized to use Microsoft Intune. Contact your system administrator if you think you have received this message in error." indicates that the user who is trying to enroll the device does not have a valid Intune license.

1. Go to the Microsoft 365 admin center, and then choose Users > Active Users.
2. Select the affected user account, and then choose Product licenses > Edit.
3. Verify that a valid Intune license is assigned to this user.
4. Re-enroll the device.

XPC_TYPE_ERROR Connection invalid

When you turn on an ADE-managed device that is assigned an enrollment profile, enrollment fails, and you receive the following error message:

asciidoc
mobileassetd[83] <Notice>: 0x1a49aebc0 Client connection: XPC_TYPE_ERROR Connection invalid <error: 0x1a49aebc0> { count = 1, transaction: 0, voucher = 0x0, contents = "XPCErrorDescription" => <string: 0x1a49aee18> { length = 18, contents = "Connection invalid" } }
iPhone mobileassetd[83] <Notice>: Client connection invalid (Connection invalid); terminating connection
iPhone com.apple.accessibility.AccessibilityUIServer(MobileAsset)[288] <Notice>: [MobileAssetError:29] Unable to copy asset information from https://mesu.apple.com/assets/ for asset type com.apple.MobileAsset.VoiceServices.CombinedVocalizerVoices
iPhone mobileassetd[83] <Notice>: 0x1a49aebc0 Client connection: XPC_TYPE_ERROR Connection invalid <error: 0x1a49aebc0> { count = 1, transaction: 0, voucher = 0x0, contents = "XPCErrorDescription" => <string: 0x1a49aee18> { length = 18, contents = "Connection invalid" }

Cause: There's a connection issue between the device and the Apple ADE service.

Solution: Fix the connection issue, or use a different network connection to enroll the device. You may also have to contact Apple if the issue persists.

The configuration for your iPhone/iPad could not be downloaded from <Company Name>: Invalid Profile

Cause: The enrollment is blocked by a device type restriction.

Solution:

1. Sign in to the Microsoft Intune admin center > Devices > Enroll devices > Enrollment restrictions.
2. Under Device type restrictions, select All Users > Properties.
3. Select Edit next to the Platform settings.
4. On the Edit restriction page, select Allow for iOS/iPadOS and proceed to the Review + save page, then select Save.

ADE enrollment doesn't start

When you turn on an ADE-managed device that is assigned an enrollment profile, the Intune enrollment process isn't initiated.

Cause: The enrollment profile is created before the ADE token is uploaded to Intune.

Solution:

1. Edit the enrollment profile. You can make any change to the profile. The purpose is to update the modification time of the profile.
2. Synchronize ADE-managed devices: In the Microsoft Intune admin center, choose Devices > iOS > iOS enrollment > Enrollment program tokens > choose a token > Sync now. A sync request is sent to Apple.

ADE enrollment stuck at user login

When you turn on an ADE-managed device that is assigned an enrollment profile, the initial setup sticks after you enter credentials.

Cause: Multi-Factor authentication (MFA) is enabled. Currently, MFA doesn't work during enrollment on ADE devices if the authentication method is set to Setup Assistant (legacy).

Solution: Disable MFA, and then re-enroll the device. Alternatively, change the authentication method to Setup Assistant with modern authentication.

Authentication doesn't redirect to the government cloud

Government users signing in from another device are redirected to the public cloud for authentication rather than the government cloud.

Cause: Microsoft Entra ID does not yet support redirecting to the government cloud when signing in from another device.

Solution: Use the iOS Company Portal Cloud setting in the Settings app to redirect government users' authentication towards the government cloud. By default, the Cloud setting is set to Automatic and Company Portal directs authentication towards the cloud that is automatically detected by the device (such as Public or Government). Government users who are signing in from another device will need to manually select the government cloud for authentication.

Open the Settings app and select Company Portal. In the Company Portal settings, select Cloud. Set the Cloud to Government.

• Overall Token Sync errors
• Profile creation errors