0x8018002b: Auto MDM Enroll failed (Group Policy enrollment)
Automatic MDM enrollment through Group Policy fails with event 76, because of the user's UPN suffix or because MDM user scope is None.
From Microsoft's documentation, checked 9 Nov 2026.
Auto MDM Enroll: Failed (Unknown Win32 Error code: 0x8018002b)Also searched as: 8018002b · Event ID 76
What it means
When a Windows device is enrolled automatically through Group Policy, the enrollment task logs event 76 with 0x8018002b. Microsoft lists two causes: the user's UPN uses an unverified or non-routable domain such as .local, or MDM user scope is set to None.
Common causes
- The UPN contains an unverified or non-routable domain, such as joe@contoso.local.
- MDM user scope is set to None.
How to fix it
Read the MDM enrollment log
Look for event 76 in the MDM diagnostics admin log; Task Scheduler > Microsoft > Windows > EnterpriseMgmt shows the same result for the automatic enrollment task.
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" -MaxEvents 50 | Where-Object Id -eq 76
Fix the UPN suffix
In Active Directory Users and Computers, set a valid UPN suffix such as contoso.com on the affected users, then wait for the next sync or start a delta sync on the Entra Connect server.
Import-Module ADSync Start-ADSyncSyncCycle -PolicyType Delta
Set MDM user scope
In the Azure portal go to Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune, set MDM user scope to All or Some (with the right groups), and set MAM user scope to None.
How to confirm it's fixed
- The automatic enrollment task's last run result no longer shows the error and the device appears in Intune.
Follow Microsoft Intune failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.