How to Fix Windows Failing to Apply MDM Policy Settings

You can ignore “Windows failed to apply the MDM Policy settings” after gpupdate /force if IT confirms that your Intune-enrolled, Microsoft Entra hybrid joined PC receives policies correctly and its automatic enrollment Group Policy is attempting enrollment again. If a setting actually fails to apply, keep the PC online, synchronize it, and investigate the specific error. Use enrollment recovery only when enrollment is missing or IT identifies a problem with it.

Check whether the warning needs a repair

If the message appeared after gpupdate /force, ask IT to confirm that your PC is already enrolled in Intune, is Microsoft Entra hybrid joined, and is receiving its policies. Microsoft says the warning can be ignored when the automatic enrollment Group Policy is attempting to enroll that device again. No repair is required for that specific case.

If a setting is missing or access is blocked, tell support which setting or requirement failed. That gives IT a specific problem to investigate beyond the warning text. The Company Portal and administrator actions below apply to Intune, with other enrollment routes depending on your organization's MDM configuration.

Keep the PC online and synchronize

Keep your Intune-managed PC powered on and connected to a working network. Offline devices cannot receive policies, and Microsoft documents a normal eight-hour check-in interval. Retry Sync or allow the scheduled check-in, then ask IT to inspect Last check in if delivery remains stalled.

On Windows 11, open Start > Settings > Accounts > Access work or school. Select your organization's account, choose Info, then select Sync. Keep the internet connection active while synchronization completes.

On applicable enrolled Windows 10 devices, open Start > Settings > Accounts > Access work or school, select the organization's account, then choose Info > Sync. This route requires a connection that exposes Info. If yours does not, use Company Portal when it is installed on your Intune-enrolled PC.

In the Windows Company Portal app, open Settings > Sync. Alternatively, right-click the Company Portal icon in the taskbar or Start menu and select Sync this device. Choose whichever synchronization route you can access.

For a remote sync, ask an administrator with the required permissions to open Devices > All devices in the Microsoft Intune admin center and select your PC. They can select Sync, then select Yes. Where available, they can inspect Device sync status; the enhanced view requires turning on Preview new device view.

If you administer a licensed Intune tenant, you can automate synchronization with an authenticated POST request to the Microsoft Graph syncDevice action for the affected Intune managed-device ID. Send no request body, and use delegated or application permission DeviceManagementManagedDevices.PrivilegedOperations.All. A successful request returns 204 No Content.

For stalled extension-managed apps, scripts, or remediations, an administrator can open Task Manager > Services, right-click IntuneManagementExtension, and select Restart. This triggers an extension check-in on devices with Intune Management Extension installed. It is not a universal repair for native MDM policy.

Resolve requirements that block device access

For a compliance or access failure, open Company Portal > Devices and select the affected PC. Under Device status, select Check access. This checks requirements affecting access rather than repairing every configuration-policy error.

When a requirement fails, select How to resolve this or Resolve and complete the indicated correction. Select Check access again afterward. If you cannot correct the setting locally, select Contact IT.

You can also run the access check with the keyboard in Windows Company Portal. Focus the device tile or open its details, then press Ctrl + M or F9.

To check a listed PC from another device, open the Company Portal website. Sign in only through Microsoft’s own app or website, and never share a code, password, or remote access with someone who contacts you. Sign in with your work or school account, open Devices, select the PC, then under Status, select Check status and follow its device-specific instructions.

Restore enrollment when it is missing

Use enrollment setup when enrollment is missing or IT has diagnosed a need to enroll the PC again. If your organization requires Company Portal and you need the app, get it from the official Microsoft Store product page, subject to your device's compatibility and enrollment requirements. Use the enrollment method your organization supports.

On Windows 11, or applicable Windows 10 devices running version 1607 or later, open Company Portal and sign in with your work or school account. On Home, select Next, then select Connect and authenticate again. On Setting up your device, select Go. After setup finishes, return to Company Portal, select Next, then select Done.

For the work-account connection route on Windows 11, open Settings > Accounts > Access work or school > Connect. On applicable Windows 10 devices, open Settings > Accounts > Access work or school > Connect. Enter your organizational email address and complete authentication, including multifactor authentication when requested. MDM enrollment occurs during this flow only when your organization has applicable automatic enrollment configured.

If your organization supports MDM-only enrollment, on Windows 11 open Settings > Accounts > Access work or school > Enroll only in device management. On applicable Windows 10 devices, open Settings > Accounts > Access work or school > Enroll only in device management. Enter your work email address and complete your organization's authentication flow. This method does not substitute for an organization-required Microsoft Entra join.

If IT provides an enrollment deep link for your Windows 11 or applicable Windows 10 PC, open it using Microsoft Edge. Enter your organizational email address and complete authentication in the Windows enrollment window. If enrollment fails, give the error code to support so they can investigate enrollment eligibility and configuration.

Collect the error code and management reports

On Windows 11 or an applicable Windows 10 MDM client, open Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin. Examine the relevant event's error code and provide it to IT. For automatic enrollment, event 75 indicates success and event 76 indicates failure; those events do not describe every individual policy setting.

To export management logs on an enrolled Windows 11 PC, open Settings > Accounts > Access work or school > Export your management log files. On an applicable enrolled Windows 10 PC, open Settings > Accounts > Access work or school > Export your management log files. Retrieve the files from the displayed location and give them to organizational support. Microsoft lists C:\Users\Public\Public Documents\MDMDiagnostics for this export.

For an advanced report on an MDM-enrolled Windows 11 PC, open Settings > Accounts > Access work or school, select the organizational account, then choose Info > Create report. Select Export to save the diagnostic output. This collects troubleshooting information rather than repairing the policy itself.

On an MDM-enrolled Windows 10 PC, open Settings > Accounts > Access work or school, select the organizational account, then choose Info > Create report and select Export. For either version, inspect the output in C:\Users\Public\Documents\MDMDiagnostics. Its MDMDiagHtmlReport.html file summarizes management configuration and policies.

You can also collect a diagnostic archive with the built-in tool on Windows 11 or Windows 10. Run this command, then give the resulting archive to IT for analysis.

mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"

If the setting still fails, sign in to the Company Portal app and open Help & support. Provide the warning text, actual error code, failed policy or setting, and diagnostic files.

Correct assignments and conflicting profiles

If you administer Intune, open Troubleshooting + support > Troubleshoot > Select user, choose the affected user, and select Select. Inspect Intune license, Managed, Last check in, Device Compliance, and Device Configuration. Correct missing enrollment or policy assignments, and check Tenant Status for subscription and service incidents.

With profile-editing permissions, open Devices > All devices, select the PC, and open Device configuration. Select the affected policy and its Conflict row to identify competing profiles. Correct their settings or assignments, then synchronize the device. Review applicability when a setting is reported as unsupported.

If you have access to Copilot in Intune, open Devices > Manage devices > Configuration and select the policy. Expand its Configuration settings category, select the setting's Copilot tooltip, and enter conflicts in Copilot Chat. Alternatively, open the policy from the Policies tab and select Summarize with Copilot. Use the results to investigate the conflict; this action does not automatically repair the policy.

Repair automatic enrollment configuration

With the required administrative access and Intune and Microsoft Entra ID P1/P2 licensing, open Devices > Device onboarding > Enrollment > Windows > Automatic Enrollment in Intune. Configure MDM user scope as Some with the intended users, or All when appropriate. Verify the default MDM URLs, avoid overlapping BYOD WIP scope, and select Save.

If enrollment during app sign-in is unexpectedly absent, inspect Disable MDM enrollment when adding work or school account. Microsoft labels this control public preview. Its restriction does not block the Windows Settings enrollment flow.

For eligible domain-joined Windows 11 Pro, Enterprise, or Education devices with Microsoft Entra hybrid join infrastructure, or applicable Windows 10 equivalents, review the enrollment GPO. Open Computer Configuration > Administrative Templates > Windows Components > MDM > Enable automatic MDM enrollment using default Microsoft Entra credentials. Enable it, choose User Credential for ordinary user-based enrollment, and verify the GPO link and security filtering. Investigate Disable MDM Enrollment if error 0x80180026 appears.

If automatic enrollment never started, have IT use administrative credentials to inspect Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt. Only when the enrollment GPO did not apply, run the following command in Command Prompt, then recheck enrollment events. This reapplies Group Policy rather than synchronizing MDM and can reproduce the harmless warning on an already enrolled device.

gpupdate /force

Resolve conflicts between MDM and Group Policy

If the conflicting setting belongs to Policy CSP, your administrator can configure MDMWinsOverGP through MDM. Deploy integer 1 to ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP at device scope. This mechanism does not cover every CSP or Group Policy setting, so resolve duplicate configuration at its source when it does not apply.

This precedence option applies to Windows 11 Pro, Enterprise, Education, IoT Enterprise, and IoT Enterprise LTSC, with a documented Windows 10 baseline of version 1803 or later. Have your administrator check the device's applicability before deployment. A conflict outside this policy's scope still needs correction in the competing configuration.

Windows Update has a dedicated precedence policy for Windows 11 version 24H2 with KB5101684, build 26100.8973, and later, on Pro, Enterprise, Education, and IoT Enterprise editions. First configure the equivalent update-management settings in MDM. Enabling this policy makes Windows ignore Windows Update Group Policy settings in favor of MDM. Only where that change is intended, deploy integer 1 to ./Device/Vendor/MSFT/Policy/Config/Update/IgnoreWindowsUpdateGroupPolicies.

Remove a management connection only when appropriate

Disconnect a management connection only after IT determines that removal is appropriate and your device permits manual unenrollment. Removal can revoke access to organizational resources. On Windows 11, open Settings > Accounts > Access work or school, select the connected account, choose Disconnect, and select Yes. If management is still required, complete your organization's enrollment process again.

Removing the connection can revoke access to organizational resources. On applicable Windows 10 devices, open Settings > Accounts > Access work or school, select the connected account, choose Disconnect, and select Yes. Complete your organization's enrollment process again if management is still required.

For a personal Windows PC eligible for self-service removal, sign in to the Company Portal website, open Devices, and select the PC. Removal can revoke work-data access. Select Remove, opening More (…) first if the action is hidden, then select Remove again. Re-enroll only if your organization requires it.

In Windows Company Portal, you can also select an eligible device's tile or open its details when your organization exposes self-service removal. The action removes the device from management. Select Remove, or press Ctrl + D or Delete, then follow the displayed removal confirmation.

Frequently Asked Questions

Can you start enrollment through the Company Portal website?

Yes, Microsoft also supports starting Windows enrollment through the Company Portal website. Your device and account must still meet your organization's enrollment requirements.

Can you choose Device Credential for ordinary automatic enrollment?

Microsoft restricts Device Credential to documented co-management and Azure Virtual Desktop multi-session scenarios. For ordinary user-based Group Policy enrollment, choose User Credential.

Can a personal Microsoft account use the Graph synchronization action?

Personal Microsoft accounts are unsupported for this action. It requires a licensed Intune tenant and the appropriate delegated or application permission.

Does Intune Management Extension support Windows in S mode?

Intune Management Extension does not support S mode. The extension restart procedure therefore does not apply to a PC running in S mode.

Who can use remote device actions in Company Portal?

Company Portal remote actions require the device's Primary User. Your organization must also expose the relevant self-service action for the device.