Microsoft Intune has become a critical tool for managing modern workplaces — but even seasoned admins run into frustrating issues. From device sync failures to app deployment problems, knowing how to troubleshoot Intune efficiently can save hours of work and boost user satisfaction.
In this article, we’ll break down 10 essential Intune troubleshooting tips every admin should know in 2025 — helping you stay ahead of common pitfalls and keep your environment running smoothly.

1. Check Intune Service Health First

Before digging into device-level issues, always check the Microsoft 365 Service Health Dashboard. Outages or degraded services in Intune or related services (like Azure AD or Endpoint Manager) can cause widespread problems.
Microsoft 365 Health Status

👉 Pro tip: Set up alerts to get notified about service health changes.

2. Use the Intune Troubleshooting Portal

The Intune Troubleshooting + Support blade in the admin center gives you a centralized view of a user’s device, app, and compliance status. This should be your first stop when investigating user-specific issues.

Navigate to:
Microsoft Intune admin center → Troubleshooting + support → Select user
Intune Troubleshooting

3. Verify Device Sync Status

Many issues — from policy failures to app deployment — boil down to stale device syncs. Check when the device last synced and trigger a manual sync if needed.

On the device:
Settings → Accounts → Access work or school → Info → Sync

4. Check Intune Logs and Diagnostic Reports

On Windows devices, use the built-in MDMDiagReport.html or Company Portal logs for detailed error messages. For macOS and iOS, leverage Company Portal diagnostic logs.

Tip: Collect logs before contacting Microsoft Support — they’ll likely ask for them.

Generate the MDMDiagReport.html

Open a command prompt as and administrator and run: mdmdiagnosticstool.exe -out C:\Users\Public\Desktop\mdmreport

Open the MDMDiagReport.html

Go to C:\Users\Public\Desktop\mdmreport and open the MDMDiagReport.html

5. Review Compliance and Configuration Policies

Misconfigured compliance or configuration policies can block access or cause repeated failures. Double-check:

✅ Assignments
✅ Applicability rules
✅ Conflicting settings between profiles

Use the Intune Admin Center → Device Configuration → Profiles

  1. Go to the Intune admin center → Devices → Configuration profiles.
  2. Click on a specific configuration profile.
  3. Go to the Per-settings status or Device status tabs:
    • This shows which devices/users have Succeeded, Error, Conflict, or Not Applicable for that profile.
  4. Look for profiles showing Conflict — these are where settings are overlapping or fighting each other.

Check Assigned Profiles Per Device

  1. Go to Devices → All devices.
  2. Select the device you want to investigate.
  3. Click Device configuration → Profiles.
  4. Look at the Assignment status column — if you see Conflict, click into it to view details.

Use Group Policy Analytics (for GPO migrations)

If you’re migrating from GPOs:

  • Go to Devices → Group Policy analytics.
  • Import your GPOs and check for potential conflicts before pushing them via Intune.

6. Monitor App Deployment Failures

Go to the Intune admin center → Apps → Monitor → App install status to check which apps are failing and why. Pay close attention to:

  • Wrong app platform (e.g., pushing Win32 to macOS)
  • Incorrect deployment type (required vs. available)
  • Dependency or detection rule failures
    Intune Troubleshooting

7. Understand Conditional Access Impacts

Conditional Access (CA) policies from Entra ID can sometimes block device registration or app access. Review CA logs under Entra ID → Sign-ins → Conditional Access to understand why a device or user is being blocked.

  1. Go to the Microsoft Entra admin center → https://entra.microsoft.com
  2. In the left-hand menu, go to: Protection → Conditional Access
  3. Under Conditional Access, look for:
    • Insights and Reporting
    • Report-only
    • Policies

Where to check CA impact on sign-ins

You won’t directly see “CA logs” under Sign-ins, but you can evaluate CA impact per sign-in like this:

  1. Go to: Entra ID → Monitoring → Sign-in logs
  2. Select a sign-in event you want to investigate.
  3. In the sign-in details pane, scroll down to the Conditional Access section:
    • You will see which CA policies were evaluated.
    • You’ll see Result (e.g., success, failure, not applied).
    • If a policy blocked or allowed the sign-in, it’s shown here.

8. Reset or Re-enroll Devices When Needed

If a device is repeatedly failing to comply or sync, sometimes the fastest fix is to remove and re-enroll it in Intune. Make sure to:

  • Remove the device record from Intune
  • Unenroll from the device
  • Re-enroll using Company Portal or Autopilot

9. Stay Updated with Intune Release Notes

Microsoft regularly pushes updates that can impact functionality or resolve bugs. Bookmark the Intune What’s New page and stay informed.

10. Leverage Community and Microsoft Support

Sometimes the fastest solution comes from the community. Check:

If all else fails, escalate to Microsoft Support with logs and detailed notes.

 

Paul Cobben