step-by-step resolution guide-for the “Invalid Client” error in Microsoft Intune, typically encountered during device enrolment or Azure AD join

step-by-step resolution guide-for the “Invalid Client” error in Microsoft Intune, typically encountered during device enrolment or Azure AD join

Common Error Message

Error: invalid_client

Description: Failed to authenticate user

Step 1: Verify Intune Licensing

- Go to Microsoft Endpoint Manager Admin Center > Users > Select the affected user.

- Ensure the user has one of the following licenses:

- Microsoft Intune

- If not, assign the correct license and wait 10–15 minutes for implementation and sync.

Step 2: Check MDM Enrollment Scope

- Navigate to:

Endpoint Manager Admin Center > Devices > Windows > Automatic Enrollment

- Ensure MDM user scope is set to Some or All.

- If set to Some, confirm the user is part of the Azure AD group targeted for enrollment.

Step 3: Confirm Azure AD Join Permissions

- In Azure AD Admin Center > Devices > Device Settings

- Check below:-

- Users may join devices to Azure AD is set to All or includes the affected user.

- Maximum number of devices per user is not exceeded.

Step 4: Validate Device Setup

- If joining during Windows setup (OOBE) ensure:

- Internet connection is stable.

- Alternatively, join via:

Step 5: Check Conditional Access Policies

- Go to Azure AD > Security > Conditional Access

- Ensure no policy is blocking device registration or MDM enrollment.

Step 6: Retry After License Assignment

- After assigning the correct license, wait 10–15 minutes.

- Then retry the enrollment or Azure AD join process.

Step 7: Optional – Disable MDM Enrollment for Non-Intune Users

users who does not need Intune:

- Set MDM scope to target only that group.

- This avoids errors for users without Intune.

Tech Made Easy: Practical IT Tips by Computer DR