The new laptop has said Setting up your device for work for two hours. The user is on the phone, the progress has not moved, and their manager wants to know if the laptop is broken. Basic troubleshooting for an Autopilot ESP problem comes down to finding which app or policy the page is waiting on, and why.
If Autopilot itself is new to you, start with how Intune Autopilot works. This post picks up where that one stops, with basic troubleshooting for the Autopilot ESP.
What the Enrollment Status Page is
The Enrollment Status Page, or ESP, is that Setting up your device for work screen. It holds the user there until apps and policies finish, so nobody gets a half-built PC. It has three phases:
Device preparation: Joining the organization's network and registering for mobile management. Self-deploying and pre-provisioned devices also secure the hardware with the TPM here.
Device setup: Security policies, certificates, network connections, and apps assigned to the device.
Account setup: The same four things for the user, after they sign in.
The Enrollment Status Page with all three phases complete. Source: Microsoft Learn.
Most basic troubleshooting for an Autopilot ESP hang starts with knowing which phase stopped. The first two phases are the device part. Account setup is the user part.
The settings that decide how it behaves
ESP profiles live in the Intune admin center under Devices > Device onboarding > Enrollment, on the Windows tab, under Enrollment Status Page.
Show app and profile configuration progress: Turn this on. The default profile hides progress, and a spinner tells you nothing.
Show an error when installation takes longer than specified number of minutes: The default is 60.
Turn on log collection and diagnostics page for end users: Gives the user a Collect logs button, plus a diagnostics page on Windows 11.
Block device use until all apps and profiles are installed: The user waits for everything.
Block device use until these required apps are installed if they are assigned to the user/device: All, or Selected with up to 100 apps. This only filters what the ESP waits for. It does not assign anything.
Allow users to reset device if installation error occurs, and Allow users to use device if installation error occurs: What the user can do on the error screen.
Install Windows quality updates (might restart the device): Adds 20 to 40 minutes after the ESP. It is on by default in new profiles.
Profiles have priorities. Intune applies the device-targeted profile first, then the user one, then Default. Target ESP profiles at device groups, because blocking apps in a user-targeted profile get ignored during the device phase.
Read the screen
Click Show details on the stuck phase. Each line says what it is waiting on, like Apps (2 of 5 installed). A line that says Error is your culprit.
Device setup stopped because of an app. Source: Microsoft Learn.
Stuck on Identifying: The user usually has no Intune license.
0x800705b4 in Device preparation: A timeout. In self-deploying mode, it usually means no TPM 2.0, like on a virtual machine.
0x801c03ea: TPM attestation failed.
0x80180014: The device was used for self-deploying or pre-provisioning before. Unblock it in the Windows Autopilot devices list.
0x80070774: A hybrid join problem.
0xc1036501: The device has more than one MDM configuration.
Get the logs
On the error screen, click Collect logs and save them to a USB drive.
On Windows 11, press Ctrl+Shift+D to open the Windows Autopilot diagnostics page. It shows network, Autopilot settings, and enrollment status, with an Export logs button.
Press Shift+F10 for a command prompt during setup, then run the command below.
The registry tracks everything the ESP waits on, under HKLM\SOFTWARE\Microsoft\Windows\Autopilot\EnrollmentStatusTracking. Under Device\Setup\Apps\Tracking\Sidecar, each Win32 app has an InstallationState. A 1 means not installed, 2 is in progress, 3 is done, and 4 is an error. A 4 stops the ESP. Take that app's ID to AppWorkload.log in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
A Win32 app's InstallationState in the registry. A 3 means it finished. Source: Microsoft Learn.
From the admin side, Devices > Monitor > Windows Autopilot deployments covers the last 30 days. The failed app's Device install status shows its error code. Collect diagnostics on the device pulls logs remotely, and Autopilot failures upload a set of logs on their own.
The usual causes
Mixing Win32 and line-of-business MSI apps: Both use the Windows installer and collide with Another installation is in progress. Package everything as Win32.
Microsoft 365 Apps with the built-in app type: Microsoft recommends packaging it as Win32 for the ESP.
Too many apps for the time limit: Raise the timeout or block on fewer apps. Only block on what the user needs on day one.
An app that restarts the PC on its own: Let Intune handle restarts. They work in Device setup but not in Account setup.
User-context scripts: They may not run during the ESP.
Hybrid join: Adds about 40 minutes on top of the timeout.
Security policies like AppLocker, App Control, or password rules: These can force restarts or break automatic sign-in during setup.
The clock is off: Run w32tm /resync /force from Shift+F10.
Conditional Access requiring a compliant device during setup: Target compliance policies at devices, not just users.
Get the user working
If Allow users to use device if installation error occurs is on, the user can continue and pick up the missing apps later. If Allow users to reset device is on, a reset starts Autopilot over. For a single broken app, fixing the app and resetting is usually faster than waiting. For new rollouts, Autopilot device preparation skips the ESP entirely and handles mixed app types.
The basic troubleshooting checklist for Autopilot ESP
Note the phase, the line in Error, and any error code.
If it says Identifying, check the user's Intune license.
Collect logs from the error screen or with mdmdiagnosticstool.
Find the app with InstallationState 4 and read AppWorkload.log.
Check the Windows Autopilot deployments report and the app's install status.
Look for mixed MSI and Win32 apps, restarts inside apps, and a timeout that is too short.
Fix the cause, then reset and run Autopilot again.
What can we learn as a person
My favorite ESP advice from Microsoft is to only block on the apps people need on day one. Everything else can install after the user is already working.
I set my own ESP to block on everything. I could not start a new hobby until I had the right gear, could not apply for the job until the resume was perfect, could not rest until the inbox was empty. Sixty minutes went by, then a year, and the screen still said Setting up your device for work.
What are you blocking on that could install after you start? And what would happen if you let yourself use the device with a few apps still pending?
A laptop dies on a Tuesday, and the user's first question is whether the stuff on their desktop is gone. If it only lived on that desktop, yes. OneDrive Known Folder Move quietly moves Desktop, Documents, and Pictures into OneDrive, so the next dead laptop is a hardware problem instead of a data problem.
Windows settings backup brings back a user's settings on a new PC, and Microsoft's own FAQ for it says user files are OneDrive's job.
What Known Folder Move does
The known folders are Desktop, Documents, and Pictures, plus Screenshots and Camera Roll inside Pictures. Known Folder Move points those folders at OneDrive. Users keep working in the same places they always have. The files get backed up and show up on any device they sign in to. The OneDrive app now calls this folder backup, so users may know it by that name. Music and Videos are not covered by the admin policies.
Set it up in Intune
Grab your tenant ID from the Microsoft Entra admin center, under Overview, in the Tenant ID box.
Intune admin center > Devices > Manage devices > Configuration > Create > New Policy.
Set Platform to Windows 10 and later and Profile type to Settings catalog.
Click Add settings, pick the OneDrive category, and add the settings below.
Assign the policy and click Create.
Picking the OneDrive settings in the Intune settings catalog. Source: Microsoft Learn.
The settings
Silently move Windows known folders to OneDrive: Enabled. Set Desktop, Documents, and Pictures to True, paste the tenant ID, and decide whether users get a notification afterward. Two settings have almost the same name, so pick the one with five sub-settings.
Prompt users to move Windows known folders to OneDrive: Add the tenant ID. Microsoft recommends pairing it with the silent setting, so users get a prompt if the silent move fails.
Prevent users from redirecting their Windows known folders to their PC: Enabled, so users cannot turn it back off.
Silently sign in users to the OneDrive sync app with their Windows credentials: Enabled. Without a sign-in, nothing moves.
Use OneDrive Files On-Demand: Enabled, so files show up without filling the disk.
Use the device versions of these settings, not the ones marked User. Assign to user groups and the settings follow the user to any enrolled PC. Assign to device groups and they apply to anyone who signs in to that PC.
Roll it out in waves
For PCs already in use, Microsoft says to keep the silent move to 1,000 devices a day and 4,000 a week. The prompt version can go to 5,000 a day. Users with huge folders can choke the internet line, so temporarily set Limit the sync app upload rate to a percentage of throughput. New PCs can get the silent policy from day one.
What the user sees
With the silent policy, not much. The folders move, the OneDrive icon is a blue cloud, and a notification may say it is done. With the prompt policy, OneDrive asks them to back up their folders.
The prompt users see when IT asks them to back up their folders. Source: Microsoft Learn.The folder backup dialog, with Desktop, Documents, and Pictures ready to go. Source: Microsoft Learn.
To check on a PC, click the OneDrive cloud, open Settings, go to the Sync and backup tab, and click Manage backup. Each folder shows whether it is backed up.
Silent sign-in has rules
The PC has to be Entra joined or hybrid joined.
Microsoft's docs say silent sign-in will not work for users who require multifactor authentication. If it keeps failing, look at your Conditional Access rules.
If you federate sign-ins, it has to be AD FS.
If it worked, OneDrive shows a blue cloud. If it failed, the user gets the Set up OneDrive screen instead.
Why folders do not move
Old folder redirection: Known Folder Move does not work if Group Policy folder redirection points the folders somewhere else, like a network share. Copy the share into OneDrive with Migration Manager first, without ticking Preserve file share permissions. Then turn off the redirection policy and turn on the move.
Already redirected to another company's OneDrive: Turn that off first, or the user gets an empty desktop.
0x80070005, An unknown error occurred: The Group Policy Prohibit User from manually redirecting Profile Folders is on. Set it to Not Configured.
Path too long: The full path has to stay under 260 characters.
Bad names: Names that start with a space or contain characters like \ : / * ? < > " | cannot sync. Files over 250 GB cannot sync either.
Folder contains a reparse point: A junction or symlink is sitting in the folder.
File is open and cannot be moved: Close it and try again. Outlook data files are a classic. They do get moved, but Outlook may complain afterward because it still looks in the old spot.
Pictures will not back up: Screenshots and Camera Roll need to be selected for syncing too.
Important folders aren't in the default locations: One known folder sits inside another.
Check from the admin side
The OneDrive sync health reports show this across the whole company. In the Microsoft 365 Apps admin center, go to Health > OneDrive Sync and click Setup to get a Tenant Association Key. Add Enable sync health reporting for OneDrive and Sync Admin Reports to your Intune profile, with the key pasted in. Reports take up to three days to show up. The Devices tab then lists which known folders moved on each PC, and the Issues tab lists errors by how many devices they hit.
On a single PC, the policy lands in the registry at HKLM\SOFTWARE\Policies\Microsoft\OneDrive. KFMSilentOptIn holds your tenant ID, and SilentAccountConfig and FilesOnDemandEnabled should be 1.
Rolling out OneDrive Known Folder Move
Turn on silent sign-in and Files On-Demand, then add the silent move for Desktop, Documents, and Pictures, with the prompt as a backup. Block users from turning it off. Clean up old folder redirection before you start, roll out in waves, and watch the sync health report.
What can we learn as a person
Users barely notice OneDrive Known Folder Move, and that is the best part. The desktop stays the desktop. Their files just stop living in only one place.
For a long time, everything I learned about my own bad weeks lived on one local drive, my head. What helped, what made it worse, which warning signs showed up first. When that drive crashed, the lessons went with it. A journal changed that. Same thoughts, same folders, but now there is a copy I can open when the hardware is having a rough day.
What lives only on your local drive right now? And where could you back it up so it survives the next crash?
Most people know the scary buttons on a device page: Wipe, Retire, and Fresh Start. I covered those in Intune wipe vs fresh start vs retire. The rest of the menu gets ignored, and that is a shame. Intune remote actions like Collect diagnostics, BitLocker key rotation, and device query close a lot of tickets without anyone touching the laptop.
Where remote actions live
Go to Intune admin center > Devices > All devices and pick a device. The actions sit across the top of the page, and the rest hide under the three dots. The newer device view groups them into menus like Remote actions, Secure, and Microsoft Defender, so the exact spot moves around a little.
The device action menu in the older layout. The newer view groups the same actions into menus. Source: Microsoft Learn.
Windows devices get Sync, Restart, Collect diagnostics, BitLocker key rotation, Rotate local admin password, Quick Scan, Full Scan, Update Windows Defender security intelligence, Locate device, Pause Config Refresh, Run remediation, and New remote assistance session. They also get the destructive ones. Remote lock is not available for Windows, only for phones, tablets, and Macs.
The everyday ones
Sync: Tells the device to check in with Intune right now. On Windows and iOS, the Device sync status tab shows how it went.
Restart: Usually starts within 5 minutes, and the user may not get a warning. Tell them before you click it.
Rename: This one is on the Properties tab under Edit, not in the action menu. It does not work on hybrid joined devices, and names cannot have spaces or be all numbers.
Locate device: On Windows, this only works if a settings catalog policy allows apps to access location.
Run remediation: Runs one of your remediation scripts on that device right now.
Pause Config Refresh: On Windows 11, stops Intune from putting settings back for up to 24 hours. That gives you room to test a change. Pause it again for 0 minutes to resume.
Collect diagnostics
This is the one to learn first. Instead of asking a user to find log files, you click Collect diagnostics, confirm, and Intune pulls a zip of everything useful off the device. It works on company-owned Windows devices.
The zip includes dsregcmd /status, ipconfig /all, the certificate stores, MDM diagnostics, Defender support files, and event logs for Application, System, Setup, BitLocker, and Windows Hello for Business. It also grabs the Intune Management Extension logs and Windows Update logs. When it finishes, open the device's Device diagnostics page, click the three dots next to the entry, and choose Download.
Collections stay for 28 days, with up to 10 per device. The whole feature can be turned off under Tenant administration > Device diagnostics, so check there if the button is missing. If the device does not pick up the request within 24 hours, the collection fails. A firewall blocking the Microsoft blob storage addresses that end in lmsas.blob.core.windows.net causes upload failures too.
Rotate BitLocker keys
Once you read a BitLocker recovery key to a user over the phone, that key has been out in the world. BitLocker key rotation makes a new one so the old key stops working. I covered where to find BitLocker keys in an earlier post.
Rotation needs Windows 10 1909 or newer, or Windows 11, and three settings in your BitLocker policy. Turn on client-driven recovery password rotation for Entra joined devices, or Entra and hybrid joined devices. Set Save BitLocker recovery information to Microsoft Entra ID to Enabled. Set Store recovery information in Microsoft Entra ID before enabling BitLocker to Required. After the rotation, the new key shows up under the device's Recovery keys page.
Defender actions
Quick scan: Checks memory, startup items, and running processes.
Full scan: Checks every file and process. It takes a while and slows the device down.
Update Windows Defender security intelligence: Pulls the latest Defender definitions down to the device.
For many devices at once, go to Endpoint security > Antivirus and use the Unhealthy endpoints or Active malware tabs. They let you run scans or restarts on up to 100 devices. Results show up in Reports > Microsoft Defender Antivirus.
Device query
Device query lets you ask a device a question and get the answer back in seconds. Is that file there? What does that registry key say? What errors hit the Application log today? You write the question in KQL, the same query language used across Microsoft's security tools, or let Copilot write it for you.
Pick the device and click Device query under Monitor. The device has to be company-owned Windows, Entra joined or hybrid joined, and set up in Endpoint analytics. It needs Intune Advanced Analytics, which is part of the Intune Suite. Since July 1, 2026, Microsoft 365 E3 and E5 include Advanced Analytics too, and existing tenants get access by August 2026. The Help Desk Operator role cannot run it, so give the helpdesk a custom role with the Managed devices Query permission.
FileInfo('c:\windows\system32\drivers\etc\hosts') | take 10
WindowsEvent(Application, 1d) | take 1
Device query on a single device, with a query Copilot wrote from a plain English question. Source: Microsoft Learn.
Querying many devices at once
Devices > Device query runs one question across many devices. It covers Windows, iOS, macOS, and company-owned Android. Windows devices need a properties catalog policy so they report the data ahead of time. You get 10 queries a minute and 1,000 a month, and you can export the results or add every device in them to a group.
Tpm | where Enabled != true
OsVersion | summarize DevicesCount = count() by OsVersion
Device query across many devices from Devices > Device query. Source: Microsoft Learn.
Bulk actions and who did what
Go to Devices > All devices > Bulk device actions, pick the operating system and the action, add up to 100 devices, and click Review + create. On Windows, bulk works for Sync, Restart, Rename, Collect diagnostics, Autopilot reset, Retire, Wipe, and Delete. Collect diagnostics caps out at 25 devices. Each tenant can only wipe 500 devices a day and retire or delete 1,000.
To see whether an action finished, check the device actions report under Devices > Monitor. It shows the status and who started each action. To see who did something, go to Tenant administration > Audit logs and filter on the Device category. If nothing shows up in the audit log, the user probably did it themselves from the Company Portal. Wipe, retire, and delete can also require a second admin's approval through Multi Admin Approval.
When an action is stuck or greyed out
Stuck on Pending: The device is offline. Actions wait for the next check-in.
Greyed out: The platform does not support it, like Remote lock on Windows or Pause Config Refresh on Windows 10.
Greyed out on one device but not another: Rename does not work on hybrid joined devices, and diagnostics and device query need a company-owned device.
Missing for one admin: Their role lacks the permission. Help Desk Operator covers most actions, but not device query or Pause Config Refresh.
Make Intune remote actions part of every ticket
Make Collect diagnostics the first step on any Windows ticket you cannot solve in five minutes. Rotate BitLocker keys after every recovery, and keep a few device queries saved for the questions you ask every week. Those three Intune remote actions alone save a lot of walking to desks.
What can we learn as a person
Pause Config Refresh is a small action with a nice idea behind it. Normally Windows keeps putting your settings back. Change something, and a little later it snaps back to policy. Pause it, and for up to 24 hours you get room to try something without being corrected.
That button does not exist in my head. Every time I try something new, a little voice reapplies the old policy. You don't do that. That's not how you are. Back to baseline before the experiment ever gets a chance to work.
What would you try if you paused your own config refresh for one day? And whose policy is it that keeps snapping you back?
The Wi-Fi profile went out yesterday. Some of the iPhones have it. The rest are sitting on Pending like they never got the memo. The policy itself is probably fine. Basic troubleshooting for Intune on an iPhone comes down to a short list of checks. Most of them happen in the admin center before you ever touch the phone.
Here is that list, in the order I would work it.
Start with the user
A lot of policy problems turn out to be user or enrollment problems wearing a policy costume. The Troubleshoot pane shows both in one place.
Intune admin center > Troubleshooting + support > Troubleshoot
Click Select user, pick the user with the problem, and click Select.
Look for a green check next to Intune license.
Find the iPhone in the Devices list.
The Troubleshoot pane with a user selected. The green check next to Intune license is the first thing to look for. Source: Microsoft Learn.
No license, no policies. If the green check is missing, the user needs an Intune license before anything else here matters.
In the Devices list, look at two columns. Managed should say MDM. Anything else means the phone is not enrolled, and it will not get configuration policies until it is. Last check in should be recent. Microsoft's own guidance says a check-in older than 24 hours points to a problem with the device. A phone that cannot check in cannot get your policies.
Make the iPhone check in
An enrolled iPhone checks in with Intune about every 8 hours. A newly enrolled one checks in every 15 minutes for the first hour, then drops to the normal schedule. When you assign or change a policy, Intune nudges the phone to check in early. Microsoft says that nudge can land right away or take a few hours. So a policy that went out 20 minutes ago and still says Pending is not a problem yet.
You can push it along from either end:
On the iPhone, open the Company Portal app, go to Devices, tap the device, and tap Check status. Older versions of the app call it Check Settings.
In the admin center, go to Devices > All devices, pick the iPhone, and click Sync.
Then have the user unlock the phone and leave it unlocked for a minute. An iPhone will hold off on some profiles while it sits locked. Intune reports this as error 2016341112, iOS device is currently busy. You usually see it when the phone restarted and nobody unlocked it yet, or when it is in the middle of an app install or an iOS update. Unlock it, let the update finish, and sync again.
The phone also has to reach Apple. Intune wakes iPhones up through Apple's push notification service. If a phone only misbehaves on one network, like a locked down guest Wi-Fi, try it on cellular.
Check who the policy is assigned to
If the policy never shows up for the device at all, it does not target that device. In the admin center, go to Devices > All devices, pick the iPhone, and click Device configuration. Every policy aimed at the phone shows up there with a status. If yours is missing, the phone is not part of the assignment.
To dig in, open the policy from Devices > Manage devices > Configuration > Policies tab and look at Assignments under Properties. Check these:
Is the user or the device in an included group?
Is the user or the device also in an excluded group? When both groups are the same type, the exclusion wins.
Does the assignment use a filter? A filter can quietly skip devices based on things like OS version, ownership, or model.
Two group mistakes come up a lot. First, user groups and device groups behave differently. A policy assigned to a user group follows that person to every device they enroll. A policy assigned to a device group stays with the device no matter who uses it.
Second, do not assign to a device group and then exclude a user group. Microsoft does not support that mix. Intune does not connect users to their devices for exclusions, so the user's iPhone still gets the policy. Dynamic device groups also take a while to fill in after a phone enrolls, and the policy does not reach the iPhone until it lands in the group.
Why it says Not applicable
Not applicable means the phone cannot take the policy at all. On iPhones that usually comes down to supervision, the enrollment type, or the iOS version.
Supervised-only settings
A lot of iPhone restrictions only work on supervised devices. Supervised mode is for company-owned phones. They usually get it by enrolling through Automated Device Enrollment, which is the Apple Business Manager setup, or through Apple Configurator. Microsoft's restriction settings reference lists which enrollment types each setting applies to. If a setting only lists supervised Automated Device Enrollment, a regular phone skips it.
To check a phone, open Settings. A supervised iPhone shows a line at the very top saying this iPhone is supervised and managed by your organization. No line, no supervision. Intune cannot turn supervision on after enrollment. The only way is Apple Configurator, and it resets the phone.
Personal phones
Personal iPhones often use Apple User Enrollment. The user adds their work account under Settings > VPN & Device Management. That keeps work data on its own separate volume, away from personal stuff, and it gives Intune a much smaller set of controls. Supervision is off the table. If an existing policy lands on one of these phones, only the settings User Enrollment supports take effect. The phone ignores the rest.
Old iOS versions
Some settings need a newer version of iOS. If the phone is behind, the policy shows Not applicable until it updates. Check the version on the phone under Settings > General > About, and look for updates under Settings > General > Software Update.
One Not applicable is harmless. If an iPhone policy lands on a group that also has Android phones, those Android phones show Not applicable because the policy was never meant for them.
Conflicts and errors
Conflict means two policies set the same setting to different values, or something already on the phone stops Intune from changing it. Intune does not pick a winner between configuration policies. Someone has to fix it by hand.
Open the policy and click Per setting status. That shows exactly which setting is fighting. Then go find the other policy that sets it. Check the settings catalog, the device restriction templates, and the compliance policies. When a compliance policy and a configuration policy touch the same setting, the compliance policy wins.
A policy's status counts, with the Device assignment status and Per setting status reports underneath. Source: Microsoft Learn.
Custom profiles are the sneaky ones. If someone uploaded a .mobileconfig file as a custom profile, Intune delivers it without reading what is inside. If it fights with another policy, Microsoft's docs say Apple applies the settings randomly. Fun.
For Error, click into the device on the policy report. Most errors come with a code you can search on Microsoft Learn. Put that code in the ticket either way.
If someone loosens a policy, some iPhones hold on to the stricter version, and that looks like a conflict. Microsoft's fix for that is to retire the phone and enroll it again. That is a bigger job, so escalate it.
Profiles that depend on other profiles
Wi-Fi, VPN, and email profiles often use certificates to sign in. The Wi-Fi profile points to a client certificate profile, either SCEP or PKCS, and usually a trusted root certificate profile too. If those certificate profiles fail, or they do not go to the same users or devices, the Wi-Fi profile fails right along with them.
So when a Wi-Fi profile errors out, check the certificate profiles for that same iPhone first. Fix those, sync, and the Wi-Fi profile usually follows.
When every iPhone stops at once
If one phone is broken, it is a phone problem. If every iPhone and iPad in the company stopped getting policies on the same day, check the Apple MDM push certificate before anything else. Intune needs it to talk to Apple devices at all. It lasts 365 days, and someone has to renew it every year.
Intune admin center > Devices > Device onboarding > Enrollment
Select the Apple tab.
Click Apple MDM Push Certificate.
Check the Status and the Days until expiration.
The Apple MDM Push Certificate pane. Status and Days until expiration sit right at the top. Source: Microsoft Learn.
If it expired or is about to, escalate right away. After it expires there is a 30-day grace period to renew it, and the renewal has to use the same Apple ID that created it. Whoever handles it should renew the existing certificate, not create a new one. A brand new certificate means enrolling every Apple device again. That is a very long week.
While you are in there, check Tenant administration > Tenant status for active incidents. Sometimes the problem really is Microsoft.
What the iPhone can tell you
The phone keeps its own list of what Intune installed. Go to Settings > General > VPN & Device Management, tap the management profile, and tap More Details. You will see the profiles, restrictions, and certificates the phone actually has.
In basic troubleshooting for Intune on an iPhone, this is a quick way to cut the problem in half. If the Wi-Fi profile is in that list but the phone still will not connect, the profile arrived fine and the problem is the network or the certificate. If it is not in the list, go back to check-ins and assignments.
The basic troubleshooting checklist for iPhones
Basic troubleshooting on an iPhone with Intune is mostly the same handful of checks in the same order every time:
Confirm the user has an Intune license in Troubleshooting + support.
Confirm the iPhone shows Managed as MDM and has a recent last check-in.
Unlock the phone, then sync from the Company Portal or the admin center.
Make sure the policy shows in the device's Device configuration list.
Check the policy's included groups, excluded groups, and filters.
For Not applicable, check supervision, enrollment type, and iOS version.
For Conflict, use Per setting status to find the other policy.
For Wi-Fi, VPN, or email failures, check the certificate profiles first.
If every Apple device stopped at once, check the Apple MDM push certificate.
Look under VPN & Device Management on the phone to see what actually arrived.
If you escalate, include the user, the device name and serial number, the iOS version, whether the phone is supervised, the policy name, its status, any error code, and the last check-in time.
What can we learn as a person
Apple's MDM protocol has a status called NotNow. The phone got the command, it just cannot do it at the moment, so it says so and checks back later. I like how honest that is. It does not pretend it finished, and it does not ignore the request forever.
I send NotNow a lot. The doctor's appointment, the conversation I owe someone. The difference is the iPhone actually polls the server again later. I mostly do not. The command just sits at Pending until somebody notices my last check-in date is way too old.
So what have you been answering with NotNow? And when did you last check back in on it?
An iPhone three versions behind is a security ticket waiting to happen. A store tablet that updates itself in the middle of the holiday rush is a different kind of ticket. Intune Apple and Android updates work nothing like Windows update rings. Apple also just changed how its side works, so the policies a lot of tenants built a few years ago are on their way out.
Apple moved updates to declarative device management
The old way had Intune send an update command to the iPhone and then keep asking how it was going. With declarative device management, or DDM, Intune tells the device the version it needs and the deadline. The device handles the rest and reports its own progress.
Apple deprecated the old update commands in its 26 releases and drops them completely in the 27 releases. Microsoft says it is removing the legacy iOS/iPadOS and macOS update policies from Intune in the coming months. If you still have policies under Devices > Apple updates, plan to replace them now.
DDM updates need iOS/iPadOS 17 or newer, or macOS 14 or newer.
They work with Device Enrollment and Automated Device Enrollment, not User Enrollment.
On a Mac, enforcing a version needs a supervised device. On an iPhone, it works supervised or not.
On iPhones, the deferral and automatic install controls only work on supervised devices.
Create a DDM update policy
Intune admin center > Devices > Manage devices > Configuration > Create > New policy
Pick iOS/iPadOS or macOS, then Settings catalog.
Click Add settings and open Declarative Device Management.
Pick Software Update to target a specific version, or Software Update Enforce Latest to always chase the newest one.
Fill in the settings and assign it to a device group.
Target OS Version: The version devices must reach, like 26.0.
Target Build Version: Optional. If it disagrees with the OS version, the OS version wins.
Target Date Time: The deadline, in the device's own time zone.
Details URL: A link users see in the update prompt, like your IT help page.
For Software Update Enforce Latest: Delay in Days and Install Time, in 24-hour format.
At the deadline, the device shows a one-minute countdown, then installs and restarts. A device that was powered off gets one hour after it powers back on. If the device sits idle before the deadline, it may install early.
Software Update Settings
The same Declarative Device Management area has a Software Update Settings category. It controls whether standard users can install updates, automatic downloads and installs, and Apple's fast security fixes, which Apple now calls Background Security Improvements. It can also hide updates for a set time, offer major or minor updates, and keep update notifications quiet until an hour before the deadline. These replace the old Defer software updates and Delay visibility of software updates settings in device restrictions.
What users see
The reminders get more frequent as the deadline gets close. Do Not Disturb is ignored for the last 24 hours. An iPhone needs the passcode to start the update. At the deadline, a Mac force quits every open app, so warn people to save their work.
A required managed update notification on a Mac. Source: Microsoft Learn.
Checking Apple updates
Go to Reports > Device management > Apple updates. The Summary tab shows the latest version for iOS, iPadOS, and macOS, and how many devices are up to date, waiting, downloading, installing, or failed. The Reports tab has the Apple software update report with per-device detail.
The Apple updates Summary report for macOS, iOS, and iPadOS. Source: Microsoft Learn.
For one device, open it and look under Monitor for iOS software updates or macOS software updates. Devices > Monitor > Apple software update failures lists the ones that did not make it. On the device itself, check Settings > General > Software Update on an iPhone, or System Settings > General > Software Update on a Mac.
Apple update gotchas
Succeeded on the policy only means the policy landed. Check the actual OS version on the device.
A device already newer than the target shows an error because it looks like a downgrade. Retire old policies when you raise the target.
If the target version does not exist for that model, the device keeps the policy and waits.
If a user turned off automatic updates on their iPhone, a policy cannot turn them back on.
Low battery, low storage, or a powered-off device at the deadline all delay the install.
Android system updates
For company-owned Android devices, meaning fully managed, dedicated, and corporate-owned work profile, updates live in a device restrictions profile. Go to Devices > Manage devices > Configuration > Create, pick Android Enterprise and Device restrictions, and open General. If those enrollment types are new to you, start with Android Enterprise management types.
Device Default: Installs when the device is on Wi-Fi, charging, and idle.
Automatic: Installs updates as soon as they are available.
Postponed: Holds updates for 30 days, then prompts the user. Some manufacturers still push security updates anyway.
Maintenance window: Installs only during a daily time window you pick, and keeps trying for 30 days. Low battery or storage makes it fail.
An Android maintenance window from 6 to 8 in the morning. Source: Microsoft Learn.
Freeze periods for system updates block updates completely for up to 90 days, which is handy for a store during the holidays. Dates use MM/DD, and each freeze has to be at least 60 days apart from the next. It needs Android 9 or newer. Not every manufacturer supports these controls, so test on your actual hardware.
Firmware over the air for Samsung and Zebra
Intune can also push manufacturer firmware updates to Samsung and Zebra devices. It is an Intune Plan 2 feature. Microsoft 365 E3 and E5 have included Plan 2 since July 1, 2026, and existing tenants get access by August 2026. Connect it under Tenant administration > Connectors and tokens > Firmware over-the-air update, then create deployments under Devices > Android > Manage updates > Android FOTA deployments.
Samsung needs a Knox E-FOTA license, a Knox admin account, and Managed Google Play. The Knox E-FOTA app also goes on the device, and the user accepts its terms once. Zebra LifeGuard works on fully managed and dedicated devices only. Zebra deployments do not retry after a failure, and you can never downgrade, because a downgrade wipes the device. I covered getting them enrolled in enrolling Zebra scanners into Intune.
A plan for Intune Apple and Android updates
Replace any legacy Apple update policies with DDM Software Update policies before Apple's 27 releases arrive. Give users a real deadline and a Details URL that explains it. For Android, pick a maintenance window on company devices and add freeze periods for your busy seasons. Then check the Apple updates report weekly, because Intune Apple and Android updates only work if someone looks at the failures.
What can we learn as a person
Android has a rule I love. You can freeze system updates for up to 90 days, like over the holidays at a store. But each freeze has to sit at least 60 days apart from the next one. You cannot stack them into a permanent freeze.
I stack them. Busy season, then a hard month, then a big project, and every time I tell myself the change can wait until things calm down. Things never calm down, so the freeze never lifts, and the updates I actually need pile up.
How long has your freeze been running? And what would happen if you let one update through before the next busy season starts?
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
