How to Fix Intune 401 Permission Denied Error When Enrolling Devices
Question details
The user encounters a 401 Permission Denied error when attempting to enroll devices via mobile device management (MDM) or access Intune device data.
- Product
- Microsoft Intune
- Device & OS
- not provided
- Scenario
- Enrolling new devices or accessing device data in Microsoft Intune.
- Observed behavior
- A 401 error is displayed, indicating that the account lacks the necessary permissions or licenses, and the enrollment process is blocked.
Ensure you have access to the Microsoft 365 Admin Center with Global Administrator or Intune Administrator credentials before attempting to modify role permissions or licenses.
Verify Intune Role Permissions and Licenses
Check if the account attempting to enroll the device has been assigned the necessary Intune licenses and administrative roles.
A 401 error is typically an authorization failure. In the context of Microsoft Intune, it means the user account is either missing a required license or lacks the correct role-based access control (RBAC) permissions to perform device enrollment.
Sign in to the Microsoft 365 Admin Center using an administrator account.
Go to 'Users' and select 'Active users' from the left-hand navigation menu.
Select the user account experiencing the error, click on 'Licenses and apps', and verify that a valid Intune license is assigned.
Open the Microsoft Endpoint Manager admin center, navigate to 'Tenant administration' > 'Roles', and confirm the user has the appropriate device enrollment permissions.
Activate Basic Mobility and Security
If you are utilizing Basic Mobility and Security for Microsoft 365, ensure the service is fully activated for your tenant.
Equip Your Managed Devices with WPS Office
While resolving device management and policy errors in Intune, consider providing your users with a fast, lightweight, and fully compatible productivity suite. WPS Office is a cost-effective alternative that deploys easily across managed devices.
Frequently Asked Questions
What does a 401 Permission Denied error mean in Microsoft Intune?
A 401 error generally means the user account is not authorized to perform the action. In Intune, this usually indicates missing licenses or lacking the specific Role-Based Access Control (RBAC) permissions needed for device enrollment.
How long does it take for Intune license changes to take effect?
While some changes apply within a few minutes, license assignments and Basic Mobility and Security activations can sometimes take several hours to fully propagate across Microsoft's systems.
Can I enroll a device if I am not an Intune Administrator?
Standard users can enroll their own devices if the administrator has configured the MDM enrollment policies to allow it and assigned the proper Intune licenses to those users.
