0x80090030 is NTE_DEVICE_NOT_READY — "The device that is required by this cryptographic
provider is not ready for use." For Intune SCEP profiles that target the TPM key storage
provider, this means the TPM itself is disabled, not initialised, or otherwise unusable at
the moment of key generation.
0x80090030
NTE_DEVICE_NOT_READY: TPM not ready for use
What it means
Common causes
TPM is disabled in UEFI/BIOS or has been cleared and not re-initialised.
TPM is in lockout after too many failed authorisation attempts.
TPM firmware bug — several vendors have shipped firmware updates specifically for stuck 'not ready' states.
Virtual machines without a vTPM receiving a TPM-required SCEP profile.
How to fix it
Run
tpm.msc(orGet-Tpm) on the device: it should report ready for use. If not, the actions pane in tpm.msc offers Prepare the TPM / Clear TPM (suspend BitLocker before clearing).Check UEFI settings: TPM/security chip enabled, and on Intel platforms PTT enabled if there is no discrete TPM.
Apply vendor TPM firmware updates — check the model's support page for TPM advisories.
For VMs, either add a vTPM to the VM configuration or assign a profile that allows the software KSP.