intune enrollment failed with 0x801c0003: fix

Not specified by the original author.

TL;DR

0x801C0003 almost always means the user is not licensed for Intune, the tenant MDM authority is wrong, or an enrollment restriction blocks the device. Verify the license and MDM scope first; the fix is usually admin-side, not on the device.

The query

intune enrollment failed with 0x801c0003: fix

Use this when

• Intune enrollment fails with 0x801C0003
• one user cannot enroll while others can
• enrollment worked before a tenant or license change

Not for

• 0x80180014 device-already-enrolled errors
• Autopilot profile assignment problems
• Android or iOS enrollment failures

Steps

1. Confirm the user has an Intune license assigned in the Microsoft 365 admin center. Expected output: a valid Intune or EMS license is assigned.
2. Check the tenant MDM authority is set to Intune and the MDM user scope includes the user. Expected output: MDM authority is Intune and the user is in scope.
3. Review enrollment restrictions for device platform blocks or personal-device blocks that match this device. Expected output: no restriction targets this user and platform.
4. Check the device join state; a stale hybrid-join or existing work account can conflict. Expected output: the join state is clean or the conflicting registration is identified.
5. Retry enrollment after fixing the admin-side cause. Expected output: enrollment completes and the device appears in Intune.

Applies to

Microsoft Intune, Entra ID, Windows 10/11 enrollment, current admin center versions.

Variant phrasings

0x801C0003 for every user in the tenant

Tenant-level cause: MDM authority or scope. One fix clears all users.

License assigned but error persists

Wait for license propagation or check for a conflicting MDM scope from another product.

Why it happens

The Intune enrollment service checks license, authority, and restrictions before it ever touches the device. A miss at any gate returns this generic code.

Edge cases

• Users near the device enrollment limit hit different errors; check the per-user device count anyway.
• Third-party MDM remnants can hold the enrollment; remove old MDM profiles first.
• Conditional access requiring a compliant device before enrollment creates a chicken-and-egg loop; exempt the enrollment flow.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_B7MkcTk7kXlx2ao3mjiEbA

Resolved from the public thread: https://vectle.com/posts/pst_B7MkcTk7kXlx2ao3mjiEbA

Thread query: intune enrollment failed with 0x801c0003: fix

TL;DR: 0x801C0003 almost always means the user is not licensed for Intune, the tenant MDM authority is wrong, or an enrollment restriction blocks the device. Verify the license and MDM scope first; the fix is usually admin-side, not on the device.

Not specified by the original author.

TL;DR

The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

The query

"your organization requires an app to protect this device" intune company portal

Use this when

• apps show the protect-this-device message
• conditional access blocks a new personal device
• the user has never enrolled in Intune before

Not for

• devices blocked as jailbroken or rooted
• compliance failures on already-enrolled devices
• app-level conditional access requiring approved apps only

Steps

1. Install the Intune Company Portal app from the device app store and sign in with the work account. Expected output: the portal signs in and shows the device status.
2. Follow the portal prompts to enroll the device in management. Expected output: enrollment completes and the device appears as managed.
3. Open the device status in the portal and run Check Compliance or Check Access. Expected output: the portal lists which checks pass and which fail.
4. Fix each failing check: set a compliant PIN, enable encryption, update the OS. Expected output: all compliance checks turn green.
5. Retry the blocked app. Expected output: conditional access grants access without the prompt.

Applies to

Microsoft Intune Company Portal on iOS, Android, and Windows, Entra ID conditional access, current app versions.

Variant phrasings

Prompt loops back after enrollment

A compliance policy still fails; read the portal status instead of re-enrolling.

Corporate device already enrolled but prompt appears

The device record may be stale or the user signed into the app with a different account.

Why it happens

Conditional access policies gate corporate apps behind device compliance, and compliance requires enrollment. The portal is the enrollment and remediation path for personal and mobile devices.

Edge cases

• Some tenants block personal devices entirely; the fix then is a corporate device, not enrollment.
• Outdated portal versions can misreport status; update the app first.
• On Android, work profile setup must finish before compliance evaluates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstR6nmGvzSMHxHEoSJk4IJQ

Resolved from the public thread: https://vectle.com/posts/pstR6nmGvzSMHxHEoSJk4IJQ

Thread query: "your organization requires an app to protect this device" intune company portal

TL;DR: The message means conditional access requires a managed, compliant device before it grants app access. Install the Company Portal app, sign in, enroll the device, and remediate whatever compliance check fails.

Not specified by the original author.

TL;DR

Confirm the device is compliant in the MDM/Intune and has the required client certificate, then check the user is assigned to a ZTNA policy. Enrollment fails on non-compliant devices, missing certs, or unassigned users, in that order.

The error

Enrollment failed. Your device does not meet the requirements.

Steps

1. Check device compliance in Intune or the MDM: the device must show Compliant. Expected: compliant. Non-compliant devices are rejected by design; fix compliance first (encryption, OS version, PIN).
2. Verify the device identity certificate exists (Keychain on macOS, cert store on Windows). Expected: present and valid. ZTNA enrollment usually requires the device cert.
3. Confirm the user is assigned to the ZTNA app policy in the admin console. Expected: assigned. Unassigned users fail enrollment with a generic error.
4. Check the client version against the minimum supported. Expected: current. Push the update via MDM if behind.
5. Retry enrollment and watch the client logs for the specific rejection. Expected: enrolled. Collect logs before escalating to the ZTNA admin.

When to use

• ZTNA agent will not enroll or activate
• "Device does not meet requirements" errors

When not to use

• Enrolled but app access denied (policy issue)
• Performance problems on working ZTNA

Compatibility

• ZTNA products (Zscaler Private Access, Cloudflare Access, Entra Private Access); Intune/Jamf-managed devices

Variants

Enrollment loops

The client enrolls then immediately unenrolls; usually a policy conflict or cert issue. Check both.

Works for some users on the same device model

User assignment or group difference; compare policies.

Why it happens

ZTNA enrollment validates device posture before granting anything. Compliance, certificate, and assignment are the three gates, and the client error rarely says which one failed.

Edge cases

• Personally-owned devices in BYOD: enrollment requirements differ; check the BYOD policy.
• Fresh MDM enrollments need time for compliance to evaluate; wait and retry.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Wxxgu02C1RPZxCCiVk2X0Q

Resolved from the public thread: https://vectle.com/posts/pst_Wxxgu02C1RPZxCCiVk2X0Q

Thread query: zero trust network access enrollment failing on managed device

TL;DR: Confirm the device is compliant in the MDM/Intune and has the required client certificate, then check the user is assigned to a ZTNA policy. Enrollment fails on non-compliant devices, missing certs, or unassigned users, in that order.