Phone Email Setup and Intune Enrollment: Common Failures Fixed

Setting up email on a phone used to mean typing a server name. With Microsoft 365 and Intune it means signing in, and then a chain of policy checks decides whether the phone gets mail at all. When one link fails, the user sees a vague message about their organisation not allowing access, or the enrollment simply stalls at a spinner.

The problems fall into three groups: the tenant is not ready, the user or device is blocked by policy, or the phone itself is in a bad state. Check them in that order and most tickets close in a few minutes.

Confirm the tenant is ready

Before you blame the phone, make sure Intune is set up to accept it. This is a one-time check per tenant, but it is skipped surprisingly often on small tenants where someone turned on Conditional Access before finishing the Intune setup.

Go to intune.microsoft.com and check three things. The MDM authority under Tenant administration > Tenant status should be Intune. Under Devices > Enrollment, the platform must be allowed; Apple devices need a valid MDM push certificate, and Android Enterprise needs the managed Google Play account linked. And the user must have a licence that includes Intune, such as Business Premium, E3 or E5.

• MDM authority is set to Microsoft Intune.
• Apple MDM push certificate is present and not expired. It renews yearly and an expired one blocks every iPhone.
• Android Enterprise is connected to managed Google Play.
• Under Devices > Enrollment > Enrollment device platform restrictions, the platform and personal devices are allowed if you expect BYOD.
• Under Enrollment device limit restrictions, the user has not hit the device cap. The default is five; a user who replaced three phones this year may be at the limit.

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq 'user@yourdomain.com'" | Select DeviceName, OperatingSystem, ComplianceState, EnrolledDateTime

Outlook adds the account but mail never arrives

This is almost always Conditional Access. A policy requires an approved app or a compliant device, the phone is neither yet, and Exchange Online blocks the mailbox. Outlook shows the account and an error about the organisation requiring the device to be managed. The fix is to finish enrollment, not to fight Outlook.

Open the Entra sign-in logs, filter by the user, and find the Outlook Mobile entry. The Conditional Access tab lists the policy that failed and the control it wanted. A compliant device control means the user must enroll through Company Portal. An approved app or app protection control means Outlook must register with app protection, which needs Authenticator on iOS or Company Portal on Android installed, even if the device itself is not enrolled.

1. Check the sign-in log entry for Outlook Mobile and read the failing Conditional Access control.
2. For compliant device policies: install Company Portal, sign in, and complete enrollment. Then open Outlook again.
3. For app protection policies: install Authenticator (iOS) or Company Portal (Android), then remove and re-add the account in Outlook so it registers with the app protection service.
4. Wait a few minutes after enrollment for compliance to evaluate, then in Company Portal tap the device and choose Check status.
5. If the account was added as IMAP or as the built-in mail app, remove it. Basic authentication is off in Exchange Online, and only modern-auth clients will work.

Enrollment fails on the phone

When Company Portal stalls or fails partway, the reason is usually on the device. Old OS versions fall below the minimum set in the compliance policy. A previous enrollment left a stale management profile. Or the phone already belongs to another tenant or another user's device record.

On iOS, an enrollment that was removed from the Intune portal but not from the phone leaves a management profile behind. Go to Settings > General > VPN & Device Management and remove any old Management Profile before trying again. On Android, a work profile from a previous employer must be removed under Settings > Accounts, or the whole device reset for fully managed mode.

• Check the OS version against the compliance policy minimum. Update the phone first.
• Delete any old device record for the user in Intune under Devices > All devices, then retry.
• iOS: remove stale management profiles under Settings > General > VPN & Device Management.
• Android: remove old work profiles, and confirm Google Play services is up to date, since Android Enterprise enrollment depends on it.
• Make sure the phone has a passcode set. Most compliance policies require one and enrollment will loop on the passcode prompt until it is set.

Personal phones and the user's fears

Many enrollment tickets are really trust problems. The user does not want the company to see their photos or wipe their phone. For BYOD, prefer app protection policies without device enrollment, or Android work profile enrollment, both of which separate work data from personal data. Company Portal shows the user exactly what the company can and cannot see. For company-owned phones, use Apple Business Manager or Android zero-touch so the device enrolls at first boot and the user never has to do it by hand.

Frequently asked questions

Takeaway

Mobile email failures are policy chains, not mail server problems. Confirm the tenant is ready, read the Conditional Access result in the sign-in logs, then clear stale profiles on the phone and finish enrollment. Automating enrollment for company phones and using app protection for personal ones removes most of these tickets before they are opened.