Company Portal Can't Connect? Intune Sync Troubleshooting

TL;DR

• Don't re-enroll first. Most "Company Portal can't connect" and "device not syncing" tickets come down to five things you can check without changing anything.
• Order: (1) license + MDM user scope → (2) dsregcmd /status (look at MdmUrl, AzureAdPrt) → (3) trigger a sync and read the result in Event Viewer → (4) clock, proxy, TLS inspection → (5) rule out false alarms.
• Escalate with evidence: which step failed, sync timestamps, redacted dsregcmd output.
• If you're fixing sync so devices can pass a require compliant device policy, use the free Conditional Access Rollout Checklist before you enforce.

The ticket says "Company Portal can't connect" or "my laptop isn't getting the new policy." The tempting move is to start re-enrolling. Usually you don't need to. Most of these tickets come down to the same handful of causes, and you can check all of them without changing anything on the device or in the tenant.

Here's the order we work through, cheapest checks first. It's Windows-focused; mobile platforms have their own quirks.

Is the user licensed and in the Intune MDM scope?

You'd be surprised how many "Intune is broken" tickets end right here.

If the license was just assigned, give it time to propagate before you decide it didn't work.

What does dsregcmd /status tell you about Intune enrollment?

Run this in a normal command prompt on the device:

dsregcmd /status

Look at:

Also check Settings → Accounts → Access work or school. A healthy enrolled device shows the work account with an Info button. No Info button means there's no MDM enrollment.

How do you force an Intune sync, and how do you check that it worked?

Three places to trigger a check-in:

1. Company Portal → Settings → Sync
2. Settings → Accounts → Access work or school → account → Info → Sync
3. Intune admin center → Devices → the device → Sync (this only asks the device to check in; it doesn't force a result)

Then look at the outcome, not just the spinner:

• The Info page shows the last attempted and last successful sync times.
• Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin. Errors here are much more useful than "can't connect" in the UI.
• In the Intune admin center, compare the device's Last check-in with what the user is telling you.

If the sync time moves but the policy still doesn't show up, you have an assignment problem (wrong group, filter, user vs device targeting), not a connectivity problem.

Can a proxy or TLS inspection stop Company Portal connecting?

Yes. When the device is in scope and enrolled but still can't reach the service, it's usually the network path:

• Date/time and time zone. A clock that's off breaks TLS and token checks. Check this first; it's free.
• Proxy. Company Portal and the MDM client need to reach Microsoft's Intune and Entra endpoints. An authenticated proxy that the system context can't satisfy will block check-ins even when the browser works fine.
• SSL/TLS inspection. Breaking and re-signing traffic to Intune/Entra endpoints is a classic cause of "can't connect." Use Microsoft's published Intune network endpoints list and exclude those endpoints from inspection per your security team's process.
• Different network test. If it works on a phone hotspot and fails on the office LAN, stop debugging the laptop and talk to whoever owns the firewall.
• VPN split tunnel. Some full-tunnel VPN configs route management traffic somewhere it can't get out.

Is it really broken? Common Intune sync false alarms

These look like failures but often aren't:

How do you check a device's sync status from the admin side (read-only)?

To confirm what Intune sees without touching the device, a delegated Graph read with a read-only scope is enough:

Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All'

Get-MgDeviceManagementManagedDevice -Filter "deviceName eq 'LAPTOP-123'" -Property `
  'deviceName','userPrincipalName','complianceState','lastSyncDateTime','enrolledDateTime','managementAgent','id' |
  Select-Object DeviceName, UserPrincipalName, ComplianceState, LastSyncDateTime, EnrolledDateTime, ManagementAgent, Id

Intune Reader (or an equivalent read role) is enough for this. You don't need Global Admin to look. Keep the output off public forums, since it includes UPNs and device IDs. To track this across the whole fleet every week, see weekly read-only Intune CSV snapshots.

When should you escalate an Intune sync issue?

• License/scope checks fail: licensing / Entra admin. Not an Intune bug.
• Network checks fail: network / security team, with your evidence (works on hotspot, fails on LAN, event log errors).
• Device is enrolled and syncing but has the wrong policy: assignment review (groups, filters, user vs device targeting).
• Hybrid joined but no MDM: check the automatic MDM enrollment GPO and that hybrid join itself is healthy before anything else.
• New device stuck on the Enrollment Status Page during Autopilot: that's a different triage order (hash → profile assignment → ESP blockers → network).

Write up the ticket with the redacted dsregcmd output, the sync timestamps, and which step failed. Next time, helpdesk can get through the first three steps before it reaches you.

FAQ

How often do Intune devices sync?
Windows devices check in more often just after enrollment, then about every 8 hours. Check Microsoft's current "policy refresh intervals" doc for the exact schedule. A manual sync only asks the device to check in sooner.

Should I re-enroll a device that won't sync?
Not first. Re-enrolling throws away evidence and often doesn't fix the cause (license, scope, token, or network). Only re-enroll once the checks above point to a broken enrollment.

What does an empty MdmUrl in dsregcmd mean?
The device is joined to Entra but never finished MDM enrollment. Check the user's license and MDM user scope first.

Why does Company Portal work on a hotspot but not on the office network?
Almost always a proxy, firewall, or TLS inspection rule on the corporate network. Escalate to the network team with that evidence.

Related reading

• BitLocker still encrypting? Why Intune marks devices noncompliant
• Weekly read-only Intune device + compliance CSV snapshots with Graph
• Conditional Access report-only → enforce without lockouts

Free checklist: before sync issues turn into sign-in blocks

Devices that don't check in are one of the main reasons a require compliant device policy blocks people. The free Conditional Access Rollout Checklist has a dependency check for exactly that (devices still encrypting, not checked in, in their grace period), plus report-only, What If, and rollback steps.

👉 Get the free checklist

Want the full runbook? The Intune & M365 Admin Starter Pack includes enrollment hygiene (with a triage map for exactly these symptoms), baseline compliance, inventory snapshots, M365 admin hygiene, and 7 break/fix cards. It also comes with three read-only PowerShell scripts, including a local enrollment snapshot that runs on the device without Graph (handy for "is MdmUrl empty?"). The scripts only read; they take no device actions and make no policy changes: Intune & M365 Admin Starter Pack.

Admin Pack Studio. Not affiliated with Microsoft. Operational guidance for admins authorized to manage their tenant. Pilot first.