Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Conditional Access and Online Device registration error
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(243.2, 57.00000000000001%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHA%3C/text%3E%3C/svg%3E)
Hoffmann Andreas
0
Reputation points
We're using the Get-WindowsAutopilotInfo.ps1 script with the -Online switch to register our Entra Joined Devices, and the process is being blocked by Conditional Access.
The sign-in logs point to Microsoft Graph Command Line Tools (App ID: 14d82eec-204b-4c2f-b7e8-296a70dab67e) as the blocker. Microsoft Support suggested whitelisting several apps, but unfortunately, that hasn’t resolved the issue—likely because the device doesn’t have the compliant state during online registration.
We’re currently evaluating whether a dedicated service account with scoped permissions for Autopilot enrollment might be a solution.
Would be great to hear if anyone else has found a reliable solution to manage Device registration with Conditional Access.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2025-10-29T09:08:07.59+00:00 Hi Andreas,
Thank you for posting your query on Microsoft Q&A.
It looks like you’re facing issues with Conditional Access blocking the registration of Entra Joined Devices using the Get-WindowsAutopilotInfo.ps1 script with the -Online switch. This situation can be tricky when Conditional Access policies require device compliance during registration, causing sign-ins by the Microsoft Graph Command Line Tools app to be blocked.
Steps to help resolve this issue:
- Check Device Compliance: Go to the Intune portal and under Devices > All Devices, verify that the devices you’re registering show a compliant status. If not, ensure your compliance policies in Intune are properly configured and applied to the devices.
- Review Conditional Access Policies: In Microsoft Entra ID, navigate to Conditional Access > Policies. Look for any policies that require device compliance or block non-compliant devices from registering. Use the What If tool to simulate how the policies apply to your device and user to identify which conditional access rules might be causing the block.
- Analyze Sign-In Logs: Check sign-in logs under Entra ID > Sign-In Logs to get detailed error codes and insights about the blocked sign-ins related to device registration.
- Verify Whitelisted Apps: Since Microsoft Support suggested whitelisting certain apps, double-check that the Microsoft Graph Command Line Tools app and other required apps are whitelisted in your Conditional Access policies.
- Consider a Dedicated Service Account: If possible, use a dedicated service account with limited, specific permissions scoped to Autopilot enrollment tasks. This can sometimes bypass Conditional Access restrictions related to user compliance during online device registration.
Resources:
- Device Registration Troubleshooter Tool
- Conditional Access What If Tool
- Common Conditional Access Error Codes
- Troubleshoot registered, hybrid, and Microsoft Entra joined Windows machines - Microsoft Entra ID | Microsoft Learn
Please feel free to ask if you need further assistance. If this answer is helpful, kindly click “Accept Answer” and Upvote it.
-
Anonymous
2025-11-10T10:02:15.7966667+00:00 Hi Andreas,
Thank you for posting your query on Microsoft Q&A.
I understand that despite excluding the recommended Microsoft Intune Enrollment and related apps from Conditional Access compliance policies during your Autopilot device registration process, you are still experiencing registration failures. You also noted the concern about excluding these apps "only for the duration of the rollout," wondering if this aligns with Autopilot's intended functionality.
Clarification on Exclusions and Autopilot
- Microsoft Intune Enrollment app is usually excluded by default in Conditional Access policies during device enrollment to facilitate smooth Autopilot registration Windows Autopilot known issues.
- Excluding enrollment-related apps only during the initial registration phase helps balance security and functionality. Continuing to exclude these indefinitely may expose your environment to risks.
- The goal is to permit device registration without blocking due to missing compliant states since the compliance check happens only after enrollment completes.
Additional Troubleshooting and Recommendations
- Verify Conditional Access Policy Scope and Exclusions
- Double-check if the policy with app exclusions is properly targeted to the devices or users during the enrollment phase.
- Make sure no overlapping or conflicting policies are interfering.
- Review Intune Device Compliance and Enrollment Status
- Confirm device compliance status is correctly reported post-enrollment.
- Ensure device enrollment completes successfully in Intune portal.
- Check Autopilot Profile and Tenant Configuration
- Verify your Autopilot profiles are assigned correctly.
- Review tenant-wide Conditional Access settings for default app exclusions.
- Monitor for Platform Limitations or Bugs
- Some registration issues caused by Conditional Access compliance requirements are recognized product limitations.
- Stay updated on the Autopilot known issues page for fixes or guidance from Microsoft.
- Some registration issues caused by Conditional Access compliance requirements are recognized product limitations.
- Verify your Autopilot profiles are assigned correctly.
- Confirm device compliance status is correctly reported post-enrollment.
- Double-check if the policy with app exclusions is properly targeted to the devices or users during the enrollment phase.
- Consider Separating Enrollment Service Account Permissions
- Evaluating a dedicated service account with scoped permissions for Autopilot enrollment is a valid approach but does not bypass Conditional Access compliance checks themselves.
References
- Scenarios for using Conditional Access with Microsoft Intune
- Windows Autopilot known issues and exclusions
- Conditional Access: Grant Controls and App Exclusions
I hope you find this information helpful. Feel free to ask if you need further assistance. If this answer resolves your issue, please click “Accept Answer” and kindly Upvote it.
Sign in to comment
Sign in to answer