We are in the process of Integrating a third party MDM (on-premise) with Autopilot in AAD portal to enable Windows 10 OOBE. We want to achieve this by leveraging an on-premise Core Enterprise Application server in Azure. We have configured the following so far which is not working as expected. Also Can't find any relevant event logs within "User Device Registration" or "DeviceManagement-Enterprise-Diagnostics-Provider" :

  1. The Autopilot Device Profile was created by importing ID into Autpilot.
  2. Security Group with authorised users incl. MFA enabled Authentication
  3. Redirect URIs was also configured in MDM App used by Azure AD to join Web App via corresponding client_id which maps one of Azure DRS.
  4. Terms of Usage URLs plus secret keys was also created. MDM DISCOVERY URL & MDM TERMS OF USE URL are correctly set but havent checked if they are accessible over the Internet

NB: All of the above and a host of other requirements was double checked and tested several times. Device is able to enrol when InTune is used as the MDM server (by adding the InTune application to my Azure AD)

A Test Device out of the box was used to run the following test scenarios in Azure with an E5 incl. mdm + security subscription.

During our tests we got the following error:

****> we are not able to enroll Azure AD due to : Redirect UI
> [https://login.microsoftonline.com/WebApp/CloudDomainJoin/10] is not
> formed correctly****

After some googling i read this could be caused by DNS issues, outbound proxy issues, or a variety of other reasons.

I also read this can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. We might have sent the authentication request to the wrong tenant but checked this with a colleague today and granted all necessary permissions as required. Didnt do the trick

I also read this could simply be due to a general Authentification Failure which still looks very generic to me.

Anyone has any clues on how to troubleshoot these kinds of problems based on the error reported. Tips Will be very much appreciated.


Turns out this is a known bug by the 3rd Party MDM provider (mobileiron) and there is a simple fix for it. These are a combination of regex entries[0-9] appended to URI parameters. This fix applies only to the latest Windows 10 Builds i.e from 1809, 1903 upwards that were impacted. So anyone enrolling with the latest builds (i.e 1809 updwards)should get in touch with their mobileiron provider for this fix immediately.

The temporal workaround in my case was to roll back to 17134 and earllier windows builds, tested and finally works as expected. I am in touch with Mobileiron regarding these Regex entries.

Follow this link for further details -> https://social.msdn.microsoft.com/Forums/en-US/60c55212-fd6d-4c5c-a415-47ab404b7945/unable-to-enroll-device-into-azure-ad-using-3rd-party-onpremise-mdm?forum=WindowsAzureAD for solution.

in a nutshell if you want to avoid this error message in your test environment whiles waiting for the permanent fix from Mobileiron just roll back to the earlier windows version as stated above and go through the configuration and enrollment steps once again as a workaround. Should work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.