Intune Troubleshooting: Enrollment Failures, Devices That Will Not Sync and Win32 App Installs
A support-desk playbook for Autopilot and enrollment errors, stuck sync states, and the logs that explain failed Win32 deployments.
Enrollment and sync
Usually the Enrollment Status Page waiting on a slow app or policy. Identify which track is stuck (device vs user), remove slow Win32 apps from the ESP allow-list, and verify time sync plus connectivity to enrollment endpoints. The Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider event log and MDMDiagnostics show the failing CSP.
Force sync from Settings, Accounts, Access work or school, then confirm the Intune Management Extension service is running. Check group membership and licensing in Entra ID, then read IntuneManagementExtension.log under C:\ProgramData\Microsoft\IntuneManagementExtension\Logs plus the Enterprise-Diagnostics-Provider admin log to see what the agent last attempted.
Apps and compliance
Read IntuneManagementExtension.log for the exact exit code. Common causes: detection method mismatch (app installed but Intune disagrees), missing VC++ runtimes, install running as user instead of SYSTEM, or a pending reboot. Test the same command line locally as SYSTEM, and make detection idempotent - a stable registry key beats a drifting version string.
Open Company Portal and view device status to see the failing setting: typical culprits are minimum OS build, BitLocker or TPM attestation lag, and Defender risk level. Force sync after fixing - evaluation can lag minutes. GPO conflicts, such as password policy, can flip devices non-compliant after updates; document which policy wins.