Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The message “Your account was not set up on this device because device management could not be enabled” means Windows authenticated your work or school account, then failed when it tried to enroll the computer with a mobile-device-management (MDM) service such as Microsoft Intune. It does not, by itself, show that your password or Microsoft 365 subscription is invalid.
On a privately owned Windows PC, the quickest solution is usually to turn off Allow my organization to manage my device and choose an app-only sign-in option. If your employer or school requires a fully managed computer, only an administrator can resolve policy, licensing, quota, platform, or stale-enrollment problems.
As an Amazon Associate I earn from qualifying purchases.
What does “device management could not be enabled” mean?
Windows reached the device-enrollment stage of a work-or-school sign-in, but the organization’s MDM service rejected the request or could not finish it. The sign-in can therefore succeed while device setup fails. Microsoft describes this situation as occurring when a user chooses Set up for work or school and signs in with an organization-linked Microsoft Entra account.
MDM enrollment is separate from opening an Office application. A tenant can allow Microsoft 365 apps on a personal computer while refusing to manage that computer. Conversely, a company-owned PC may be blocked from completing setup until the tenant permits the device type, the user has the required license, and the enrollment record is valid.
Popular on Amazon
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Capture the complete message, any hexadecimal HRESULT, the correlation or trace ID, and the time shown by the sign-in screen. Those details identify the failure class far more reliably than the wording alone.
Is this a password or Microsoft 365 licensing error?
Not necessarily. The message is generated at the MDM enrollment boundary, so a correct password can still lead to it. Licensing is one possible cause, but so are enrollment restrictions, device limits, an unsupported Windows edition, an existing enrollment, or a tenant setting that disallows the operation.
If you only need to activate an app on a personal gaming or home computer, do not consent to whole-device management by accident. If the organization supplied the computer or requires compliance policies, treat the failure as an administrative enrollment issue rather than repeatedly changing your password.
What is the difference between registering a personal device and joining an organization-owned device?
Registration associates a personal device with Microsoft Entra ID for limited access and leaves it identified as personal. Joining makes the device an organization-managed endpoint on which Intune policies, compliance rules, and configuration can apply. The same sign-in dialog can offer either path, so the correct choice depends on ownership and policy.
| Enrollment model | Typical ownership | Management result | When it fits |
|---|---|---|---|
| Register in Microsoft Entra ID | Personal or BYOD Windows computer | The organization can identify the device without taking full management control | Using work apps while keeping personal-device ownership |
| Join in Microsoft Entra ID | Organization-owned or policy-required computer | The device becomes a managed endpoint and receives the tenant’s controls | Company or school computers that must meet compliance requirements |
Microsoft’s enrollment guidance summarizes the distinction as the ability to “register” or “join” devices in Microsoft Entra ID. A failed join is serious for a managed deployment, but a refused personal enrollment may be expected when the tenant does not allow BYOD management.
Why does enrollment fail with this message?
The exact cause is determined by the HRESULT and the tenant configuration. These are the principal failure paths.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Personal Windows enrollment is blocked
Intune can be configured to reject personally owned Windows devices. This is common when an organization wants to prevent management of private computers. An administrator must edit the Windows enrollment restriction and allow personally owned devices for the relevant users if BYOD enrollment is intended.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Windows MDM is disallowed by an enrollment restriction
Enrollment restrictions can block Windows MDM altogether or apply different rules to different groups. When several group-targeted restrictions exist, two users signing in from identical hardware can receive different results because they match different policies.
The account or tenant lacks a prerequisite
Authorization can fail when the user has no Intune-capable or qualifying Microsoft 365 license, the device quota is full, the device type is blocked, Windows Home is installed, or Microsoft Entra settings prevent the user from joining devices. These are tenant or edition conditions, not problems that reinstalling an app will repair.
A previous enrollment is still attached
A former user, an old work account, an Intune enrollment certificate, or a reused Windows Autopilot record can make the computer appear enrolled already. The next enrollment then collides with stale state until the old connection and, where appropriate, the cloud device record are removed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The platform or deployment mode is unsupported
Some deployment modes have extra requirements. Autopilot self-deploying and pre-provisioning, for example, depend on the correct device record and reuse state. A platform or Windows version that the MDM service does not support can produce the same top-level message.
How do I fix the error on a personal Windows PC?
Use these steps when you own the computer and only need work or school applications. Stop if your organization requires full management; in that case, follow the administrator path instead.
- Read the consent screen carefully. Look for the checkbox labeled Allow my organization to manage my device. Clear it when you do not want the organization to administer the entire PC.
- Choose the app-only option. Depending on the application and tenant, the dialog may offer wording such as signing in to this app only. Select that path instead of setting up the device for work or school.
- Finish only if support instructions permit it. Some tenants display the enrollment warning but still allow Microsoft 365 apps to work on a personal computer. An institution-specific support page may tell you to select Done after declining management; follow that instruction rather than assuming every tenant behaves identically.
- Remove an old work connection. Open Settings > Accounts > Access work or school. Select the organization’s existing connection and choose Disconnect. This removes the local work-account link; it does not delete your personal Windows profile or personal files.
- Sign in again without management. Reopen the affected Microsoft 365 application and repeat the sign-in, keeping device management disabled when the prompt appears.
- Check the Windows edition. If the computer runs Windows Home, it may not satisfy the organization’s enrollment requirements. Ask IT whether the tenant supports that edition before changing Windows.
Do not repeatedly reset Windows, wipe your game library, or purchase hardware to address a tenant restriction. None of those actions changes whether the organization allows personal enrollment or whether your account has an available MDM slot.
What should I do when the organization requires management?
If the PC is company-owned, school-owned, or required to meet compliance policy, leave the management option enabled and contact the organization’s administrator. Send a concise diagnostic package so the issue can be matched to the correct policy.
Also popular on Amazon
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
- The complete HRESULT, such as
0x80180014, if displayed. - The correlation ID or trace ID from the error dialog.
- Windows edition, version, and build.
- Whether the device is personal, newly issued, reused, or previously assigned to another user.
- The account’s user principal name and the exact UTC or local time of the attempt.
- Whether the attempt occurred during initial Windows setup, Microsoft 365 activation, Company Portal enrollment, or Autopilot.
Those facts let an administrator distinguish a policy denial from a stale certificate or a device-limit problem. Avoid creating multiple duplicate registrations while waiting; each attempt can leave additional records to clean up.
Which error code is shown, and what does it point to?
The HRESULT narrows the remedy. Microsoft’s published mappings include the following codes.
| Code | Meaning | Likely action |
|---|---|---|
0x80180014 (MENROLL_E_DEVICENOTSUPPORTED) |
The MDM server does not support the platform or version. In work-or-school setup, the same code can also accompany a tenant block on personal Windows enrollment or a Windows MDM restriction. | Verify supported Windows edition/version and review Windows and BYOD enrollment restrictions. |
0x80180013 |
The account has reached its MDM device cap. | Remove unused enrolled devices or raise the applicable enrollment limit. |
0x80180018 |
The user lacks a required Intune or qualifying Microsoft 365 license. | Assign and validate an eligible license, then retry enrollment. |
0x8018000A |
The device is already enrolled. | Remove the conflicting work connection, stale certificate, or obsolete cloud record before retrying. |
Other HRESULTs can indicate authentication, connectivity, certificate, authorization, or invalid-server-configuration failures. Never assume every instance of this message is 0x80180014; record the code that actually appears.
What should an Intune or Microsoft Entra administrator check?
Work through the tenant and device checks in this order. The order moves from account eligibility to policy, then to local and cloud residue.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall1. Verify licensing and automatic enrollment scope
Confirm that the affected user has an Intune-capable or qualifying Microsoft 365 license. Check that automatic MDM enrollment is enabled for the group containing the user. A license assigned to a different account, or a group excluded from automatic enrollment, will not authorize this user.
2. Review Windows enrollment restrictions
In Intune, inspect the enrollment restrictions that apply to the user. Ensure Windows (MDM) is allowed. For approved BYOD scenarios, permit personally owned Windows devices; leaving that setting blocked produces a predictable failure on private PCs.
3. Check Microsoft Entra device settings
Verify that the affected users are allowed to join devices and that their device-registration quota is available. A user who is prohibited from joining devices cannot complete a join even when Intune licensing is correct.
Also popular on Amazon
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
4. Inspect device-limit settings
Review the device-limit restriction and remove unused registrations. Microsoft documents a maximum device-limit setting of 15 in the cited troubleshooting flow. The effective limit can still depend on the tenant’s assigned policy and the user’s group membership.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems5. Look for an existing user or stale certificate
Determine whether another user previously enrolled the computer. On the device, remove the obsolete work-or-school connection when authorized, and check for an old Intune enrollment certificate. In the cloud, remove duplicate or abandoned device objects only after confirming they are not still in use.
6. Validate Autopilot reuse records
If the computer is deployed with Windows Autopilot, check whether its hardware record is assigned to the wrong tenant, an old user, or an incomplete deployment. Self-deploying and pre-provisioning modes have stricter reuse requirements than a normal user-driven enrollment; deleting or reassigning the correct Autopilot record may be necessary.
7. Confirm Company Portal privileges
For an already configured Windows installation using Company Portal, confirm that the Windows sign-in account has local administrator rights when the enrollment workflow requires them. New-device setup and Autopilot use different privilege paths, so do not apply this requirement indiscriminately to every deployment.
How do I remove stale enrollment safely?
Cleanup must distinguish local state from cloud identity. Removing only one side can leave the next attempt blocked.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Record the device name, serial number, current user, and Autopilot status before deleting anything.
- On Windows, open Settings > Accounts > Access work or school and disconnect the obsolete organization connection, if the device is no longer meant to use it.
- In the Intune admin center, locate the device and verify that it is not the active record for another user or deployment.
- Check for an old enrollment certificate and remove it only under your organization’s documented procedure.
- For Autopilot hardware, confirm the device belongs to the correct tenant before deleting or importing its record.
- Restart Windows, allow policy synchronization, and attempt one fresh enrollment.
Deleting a cloud object without removing a local connection can leave Windows presenting the same account. Conversely, disconnecting locally while retaining an active Autopilot assignment can cause the next reset to reapply the old deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where can an administrator see the enrollment failure?
Windows records MDM auto-enrollment events in Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin.
Also popular on Amazon
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
- Event ID 75 indicates successful automatic enrollment.
- Event ID 76 indicates an enrollment failure.
Open the event details around the failed sign-in and correlate the timestamp, HRESULT, account, and server response with Intune and Microsoft Entra audit logs. This is especially useful when the graphical dialog shows only the generic message.
Should the user fix it, or must the administrator change the tenant?
The ownership and requested management level determine who can act. A checkbox change can avoid an unwanted enrollment attempt, but it cannot override a tenant restriction for a deployment that must be managed.
| Situation | First action | Who normally completes the fix |
|---|---|---|
| Personal PC; apps only | Clear the management consent and use app-only sign-in | The user, provided the tenant allows app access |
| Personal PC; BYOD management required | Leave management enabled and provide the HRESULT and device details | Intune or Microsoft Entra administrator |
| Organization-owned PC | Do not bypass enrollment; verify policy and deployment records | Organization administrator or deployment team |
| Previously used or refurbished PC | Check local connection, certificate, Intune object, and Autopilot assignment | Administrator with authority to retire and reassign the device |
What should I avoid while troubleshooting?
- Do not guess from the headline. The same wording covers unsupported platforms, quotas, licensing, authorization, and existing enrollment.
- Do not reset a personal computer first. A reset cannot enable a blocked Windows MDM policy or add a missing license.
- Do not delete every device object blindly. You could remove a record still needed for compliance or Autopilot deployment.
- Do not create repeated test enrollments. Retries can consume device-limit slots and create duplicate records.
- Do not confuse app access with device control. Declining full management may be correct for a private PC, while the same choice can violate policy on an organization-owned one.
How can I decide the next step quickly?
Use this short decision path after recording the exact code.
- If the computer is personal and whole-device management is not required, retry with management disabled and app-only sign-in.
- If the computer is personal but policy requires enrollment, ask the administrator whether personally owned Windows devices are allowed.
- If the code is
0x80180013, clean up unused registrations or adjust the device cap. - If the code is
0x80180018, verify the user’s Intune-capable license and automatic-enrollment scope. - If the code is
0x8018000A, remove the conflicting enrollment state and check for a previous owner. - If the code is
0x80180014, validate Windows support, MDM restrictions, BYOD policy, and any Autopilot deployment mode. - If no listed code appears, use Event ID 76 and the sign-in correlation ID to investigate authentication, certificate, connectivity, or server-configuration details.
What is the practical outcome for a personal gaming PC?
If you are signing into Microsoft 365 on a privately owned Windows computer used for games and other personal software, the least disruptive configuration is usually app-only access with device management declined. That keeps the machine outside the organization’s full management boundary while allowing the tenant to decide whether the individual application may be used. If the organization’s policy explicitly requires enrollment, the administrator must make the device eligible before that account can complete setup.
Frequently Asked Questions
Can I keep using Microsoft 365 after declining device management?
Often yes, when the tenant permits app-only sign-in on personal devices. Some organizations require enrollment before granting access, so the sign-in screen or support instructions for that tenant control the result.
Will disconnecting a work account delete my personal files or games?
Disconnecting the entry under Settings > Accounts > Access work or school removes that organization connection from Windows. It does not erase a separate personal Windows profile, installed games, or personal documents, although managed data should be handled according to your organization’s policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does Windows Home always cause this message?
Windows Home can be an enrollment prerequisite failure because many managed deployments require a supported business edition. The edition alone is not proof of the cause; confirm the tenant’s supported Windows versions and the HRESULT before upgrading.
Why does the same computer work for one employee but not another?
Enrollment restrictions, automatic-enrollment scope, licenses, join permissions, and device quotas can be assigned by group. Two users on identical hardware may therefore receive different results because their accounts match different Microsoft Entra or Intune policies.
What information should I send to IT instead of a screenshot alone?
Send the exact HRESULT, correlation or trace ID, Windows edition and build, device ownership, deployment stage, and failure time. Those fields let an administrator match the attempt to Event ID 76 and the tenant’s audit records.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
