The scheduled task Schedule created by enrollment client for automatically enrolling in MDM from
Microsoft Entra ID (under Task Scheduler > Microsoft > Windows > EnterpriseMgmt) reports
Event 76 Auto MDM Enroll: Failed (Unknown Win32 Error code: 0x8018002b), and the same event is
logged in DeviceManagement-Enterprise-Diagnostics-Provider/Admin. Automatic enrolment ran and
could not complete: either the tenant isn't asking this user to enrol, or the identity the device
presents isn't one Entra ID can resolve.
0x8018002B
Auto MDM Enroll: Failed (Event 76)
What it means
Common causes
The user's UPN uses an unverified or non-routable domain suffix such as
.local— for examplejoe@contoso.local. Entra ID cannot match it to a verified domain.MDM user scope is set to None in Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune, so no user is in scope for automatic enrolment.
How to fix it
Fix the UPN suffix in Active Directory: in Active Directory Users and Computers, open the user's Account tab and choose a routable, verified suffix such as contoso.com. Select multiple users and use Action > Properties to change them in bulk.
Force a sync afterwards from the Entra Connect server with
Import-Module ADSyncthenStart-ADSyncSyncCycle -PolicyType Delta.Set MDM user scope to All, or to Some with the groups that should auto-enrol, under Microsoft Entra ID > Mobility (MDM and MAM) > Microsoft Intune. Set MAM user scope to None for Windows devices you want MDM-enrolled.
Where the UPN suffix genuinely cannot change, configuring Alternate Login ID is the documented alternative — review it carefully before deploying, it affects authentication broadly.
Frequently asked
Where do I see this error?
Task Scheduler > Microsoft > Windows > EnterpriseMgmt — the last run result of the automatic enrolment task. The same failure appears as Event ID 76 in Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.