Conditional Access Problems

Fix Intune App Deployment Delayed by MFA Synchronization

Olivia Miller Oct 12, 2026 868 views

Question details

Intune applications fail to deploy automatically, requiring users to manually open the Company Portal and complete MFA to trigger synchronization.

Fix Intune App Deployment Delayed by MFA Synchronization

Product: Microsoft Intune
Device & OS: not provided
Scenario: Automating app deployment to enrolled devices managed by Microsoft Intune.
Observed behavior: App deployment stalls in the background until the user manually syncs the device via Company Portal and passes the interactive MFA prompt after the grace period ends.

Before you start

Ensure you have Intune Administrator or Conditional Access Administrator privileges in the Microsoft Entra admin center to review and modify active policies.

Solution 1Recommended

Audit Microsoft Entra Conditional Access Policies

Identify and adjust Conditional Access policies that are prematurely blocking Intune synchronization by requiring immediate interactive MFA.

When Conditional Access policies strictly enforce MFA for all cloud apps without exceptions for device check-ins, background synchronization fails silently. The sync only succeeds when the user opens the Company Portal and fulfills the interactive MFA prompt.

Access Conditional Access settings

Review target cloud apps

Check active policies targeting the 'Microsoft Intune' or 'Microsoft Intune Enrollment' cloud apps for aggressive MFA requirements.

Check session and grant controls

Review the 'Grant' controls to see if MFA is strictly enforced before device compliance is fully evaluated.

Adjust policy exclusions

Modify the policy to allow a grace period, exclude specific trusted network locations, or adjust the sign-in frequency to allow background synchronization to succeed.

Audit Microsoft Entra Conditional Access Policies

Policy Application Delay: Changes to Conditional Access policies can take up to 24 hours to fully propagate, though they typically apply much faster. Have a test user sign out and back in to force an update.

Solution 2

Analyze Sign-in Logs to Pinpoint Blocking Policies

Use Entra ID sign-in logs to find exactly which policy is intercepting the Intune device sync.

Free Microsoft Office alternative

Simplify Your Workflow with WPS Office

Managing complex Microsoft Enterprise environments like Intune and Entra ID Conditional Access can be challenging. For everyday productivity, WPS Office offers a lightweight, free alternative to Microsoft Office. It bypasses the heavy enterprise overhead while providing everything you need to create, edit, and share documents seamlessly.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight installation that doesn't rely on complex Intune deployment rules.Completely free to use for everyday document creation and editing.Familiar user interface ensuring seamless migration and zero learning curve for your team.

microsoft office alternative - wps office

Frequently Asked Questions

Why do users need to open the Company Portal manually for apps to deploy?

If Conditional Access policies require MFA for device access but the background sync process cannot prompt the user interactively, the sync fails silently. Opening the Company Portal triggers the interactive MFA prompt, allowing authentication to succeed and the app deployment to begin.

Can I exclude Intune enrollment from MFA policies?

Yes, in Microsoft Entra Conditional Access, you can specifically exclude the 'Microsoft Intune Enrollment' cloud app from strict MFA policies. However, this should be carefully weighed against your organization's overall security and compliance requirements.

How often does Intune automatically sync with devices?

By default, newly enrolled devices check in every 15 minutes for the first hour, and then approximately every 8 hours thereafter, provided that network access and authentication policies allow non-interactive background synchronization.

Microsoft Office Security Issues