Hybrid Azure AD Join device didn't show managed by "Org name" and unable to enable co-manage

Nurfajrina Naserudin 26

I've got a few device with a weird issue where it's perfectly Hybrid Azure AD Join but inside Work or School Account > Info didn't show Managed by any organization and the last sync date.

Our environment enables co-management so all devices must be Hybrid Azure AD Join and co-managed.

Please help to advise if anyone encounters this issue. Rejoin on-premise domain, re-enroll to Azure AD and reinstall the MECM client didn't work.

Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-21T05:21:09.907+00:00
@Nurfajrina Naserudin , From your description, it seems some devices can not see the managed by "org" information. If there's any misunderstanding, feel free to let us know.

To clarify our issue, please collect the following information to us:

What are the OS version of these affected device? if we upgrade these devices to the latest version, will the issue be fixed.

Can we see this device in Intune portal? Please get a screen shot of the device information. As a note, please hide some sensitive information like domain.

Check in Azure AD portal and see if any duplicate object with the affected device there. If yes, remove them. If not, please get a screen shot of the device information in AAD to us. As a note, please hide some sensitive information.

Please collect the above information and if there's anything unclear, feel free to let us know.
Nurfajrina Naserudin 26 Reputation points

2022-06-21T06:51:53.173+00:00
Hi Crystal-MSFT,

Please find the reply as below.

What are the OS version of these affected device? if we upgrade these devices to the latest version, will the issue be fixed.
10.0.18363.2274 version We haven't try upgrading since some device with lesser version have no issue.

Can we see this device in Intune portal? Please get a screen shot of the device information. As a note, please hide some sensitive information like domain.

Check in Azure AD portal and see if any duplicate object with the affected device there. If yes, remove them. If not, please get a screen shot of the device information in AAD to us. As a note, please hide some sensitive information.

Inside Intune the device supposed to be co-manage however it fails be co-manage. We suspect it is something related with not being able to view the Work and School account details.
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-21T07:25:39.293+00:00

@Nurfajrina Naserudin , Thanks for the update.

From your information, I know the affected device is with version windows 10 1909. And as you mentioned, other device with this version can also works. So the version can't be an issue.

For the record in AAD, it seems the device's MDM is none. Here, Could you let us know how did we configure the Automatic enrollment in Intune on the configuration Manager? Was the device included?
Nurfajrina Naserudin 26 Reputation points

2022-06-21T07:51:56.79+00:00

Hi Crystal-MSFT,

We do configure same as your screenshot and the device confirm to be inside the device collections.
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-21T08:19:11.447+00:00

@Nurfajrina Naserudin , Thanks for confirming the configuration. Currently, the device isn't automatically enrolled in Intune. Please check if the MDM user scope is set all and if the MAM user scope it set None.
https://learn.microsoft.com/en-us/mem/configmgr/comanage/tutorial-co-manage-clients#configure-auto-enrollment-of-devices-to-intune

Meanwhile, check if the logging user has Azure AD Premium and Intune licenses assigned.

However, if the issue still persists, we can check if any error is logged in the Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin log in the Event Viewer: Here is alink about troubleshooting co-management enrollment for the reference:
https://learn.microsoft.com/en-us/troubleshoot/mem/intune/troubleshoot-co-management-auto-enrolling
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-24T01:58:48.357+00:00

@Nurfajrina Naserudin , Hope things are going well. I am writing to see if our issue is resolved. if there's any update, feel free to let us know.
Nurfajrina Naserudin 26 Reputation points

2022-06-27T06:52:06.913+00:00

Hi Crystal-MSFT,

As checked, both MDM and MAM user scope is correct.

The user is license with M365 E5 and out Azure AD have Azure AD Premium P2.

There no error found under DeviceManagement-Enterprise-DIagnostic-Provider Admin log.

We already log a case to Microsoft regarding this and for almost a month there is no fruitful findings to even check further on this issue.
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-27T08:58:34.367+00:00

@Nurfajrina Naserudin , Thanks for letting us know the status. From your description, it seems no error in DeviceManagement-Enterprise-DIagnostic-Provider Admin log. Maybe the enrollment is not triggered. This needs to look into the Configuration Manager side to see if the device side receive the action to do the enrollment. The issue is a little complex. And may need cross team support. I notice you have opened a case. Maybe you can wait some more time to see if it can be fixed in the case.

@anyone, If anyone has met this. I appreciate your help to share the solution here. Thanks!
Nurfajrina Naserudin 26 Reputation points

2022-06-28T05:22:37.587+00:00

Hi Crystal-MSFT,

I would like to add on when I run dsregcmd/status command there only MDMUrl available while the MdmTouUrl and MdmComplianceUrl didn't show any value. I check with a normal device and find out those three should have URL.

I also check the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments and found the status is as below.

"Status"="Failed to process server enrollment provisioning, rolling back"

The error from comanagementhandler log is "Failed to check enrollment url, 0x00000001;"
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-06-28T07:38:15.173+00:00

@Nurfajrina Naserudin , From the information you provided, it seems the MDM enrollment URL is not available. Given the situation, please check if all the required services and ports are allowed access on these affected devices. Is any firewall or network device block the access:
https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints

Please check the above information and if there's anything unclear, feel free to let us know.

1 answer

Nurfajrina Naserudin 26 Reputation points

2022-08-01T04:35:18.993+00:00

Hi All,

The issue solved by deleting the Enrollments registry under "HKLM > Software > Microsoft > Enrollments". After that run gpupdate > restart > gpupdate.

https://learn.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

Thanks.
Please sign in to rate this answer.
Crystal-MSFT 43,721 Reputation points Microsoft Vendor

2022-08-01T04:59:45.83+00:00

@Nurfajrina Naserudin , Thanks for the update. I am glad to hear that our issue is resolved. And thanks for sharing your solution. it can help others who has the same issue. I appreciate it.

Again thanks for your time and have a nice day!

Christopher Oliveira 0 Reputation points

2023-08-14T13:40:23.1233333+00:00

Hello,

It did fixed the issue for us too but what is causing this? as we have so many computers...

Thank you

Nurfajrina Naserudin 26 Reputation points

2023-08-15T03:21:56.21+00:00

Hi,

Based on Microsoft support reasoning, it's because of the previous old enrollment that didn't clean up properly. It is supposed to be auto cleanup once you are done re-enrollment but there are some cases that it's not properly cleaned up by the system and we need to do it manually.

Thank you.
Sign in to comment