Fix Autopilot Device Preparation Error 80180003: 4-Phase Triage Guide

What Is Autopilot Device Preparation Error 80180003?

Windows Autopilot Device Preparation Error 80180003 is an MDM enrollment rejection that occurs during the Windows Out-of-Box Experience (OOBE). It halts provisioning with the message “This user is not authorized to enroll.” The root cause is a blocked Entra device join limit, misconfigured MDM user scope, or an unflagged personal device restriction in Intune.

In modern Microsoft 365 cloud management, Windows Autopilot Device Preparation (commonly known as Autopilot v2) eliminates the hassle of capturing and uploading 4K CSV hardware hashes before deployment. You hand the user a factory-sealed laptop, they sign in with their Microsoft Entra ID credentials, and Intune takes over.

But when OOBE crashes into error 80180003, IT teams often waste hours troubleshooting user licenses. While the phrasing sounds like an account restriction, 80180003 is almost always an MDM Enrollment Handshake Block at the directory gateway.

I’ve resolved this across dozens of enterprise tenants migrating from legacy Hybrid Autopilot to cloud-native Entra joins. Here is the exact 4-phase triage framework to isolate the roadblock and get machines enrolling in minutes.

How to Fix Autopilot Device Preparation Error 80180003 (4-Phase Framework)

To eliminate Error 80180003 without guesswork, audit your tenant across these four operational checkpoints:

1. Phase 1: Identity & Tenant Authority — Verify Microsoft Entra device join permissions and verify MDM authority status.
2. Phase 2: Mobility & Scope Alignment — Match Intune automatic MDM enrollment scopes and confirm Plan 1 licensing.
3. Phase 3: Device Quotas & Corporate Gateways — Clear stale device registration limits and upload Windows Corporate Identifiers.
4. Phase 4: Policy Collisions & Hash Cleanup — Purge legacy classic Autopilot hardware hashes from the portal.

Phase 1: Identity & Tenant Authority Verification

1.1 Confirm Microsoft Entra Join Permissions

User-driven Autopilot Device Preparation requires the provisioning identity to have explicit permission to join endpoints to your directory.

1. Sign in to the Microsoft Entra Admin Center.
2. Browse to Devices > Device settings.
3. Locate Users may join devices to Microsoft Entra.
4. Confirm this is set to All, or Selected with your deployment group added. If set to None, OOBE fails immediately with 80180003.

1.2 Verify Active MDM Authority

Confirm that your tenant’s mobile device management authority is verified. In the Microsoft Intune Admin Center, go to Tenant administration > Tenant status and check that MDM authority displays Microsoft Intune.

Phase 2: Mobility & Licensing Scope Alignment

2.1 Configure Automatic Intune MDM Enrollment

During initial sign-in, Entra ID must automatically pass the management session to Intune. If the user isn’t in scope, the handoff fails.

1. Navigate to Microsoft Entra ID > Mobility (MDM and WIP) > Microsoft Intune.
2. Set MDM user scope to All (or Some, ensuring the pilot user security group is targeted).
3. Set MAM user scope to None. Leaving MAM active on Windows endpoints creates dual-enrollment race conditions with Win32 application delivery.

2.2 Validate User License Entitlements

Verify that the testing account has an active license that includes Microsoft Intune Plan 1. This is included with Microsoft 365 E3, E5, Business Premium, or standalone Enterprise Mobility + Security (EMS).

Phase 3: Device Quotas & Corporate Platform Gateways

3.1 Check Maximum Devices Per User Limit

Microsoft Entra ID limits the number of devices an individual user can register. If an IT engineer or test account has built dozens of virtual machines or staged retired laptops, subsequent joins get rejected.

1. In Entra Admin Center, open Devices > Device settings.
2. Check the Maximum number of devices per user setting (default is 20 or 50).
3. Navigate to the user’s profile and delete inactive or decommissioned test workstations.

3.2 Add Corporate Identifiers for Tenants Blocking Personal BYOD

Many enterprises block Personally Owned Windows (MDM) devices under Enrollment Device Platform Restrictions. Because Autopilot Device Preparation does not pre-register hardware hashes, Intune views out-of-the-box hardware as personal by default—triggering error 80180003.

To let fresh hardware enroll without reverting to 4K CSV hash collection:

1. Open Microsoft Intune > Devices > Enrollment > Corporate device identifiers.
2. Click Add > select Windows (MDM).
3. Enter the device Manufacturer, Model, and Serial Number.
4. During OOBE, Intune queries the hardware serial, flags the workstation as Corporate, and bypasses your personal enrollment block.

Phase 4: Policy Precedence & Classic Hash Conflicts

4.1 Delete Legacy Classic Autopilot Hardware Hashes

A workstation cannot run both Classic Windows Autopilot and an Autopilot Device Preparation profile simultaneously. If the serial number or hardware hash is still listed under Windows enrollment > Devices, the classic profile takes precedence and creates token collisions.

Fix: Delete the device hash from the classic Windows Autopilot device list before triggering Device Preparation OOBE.

4.2 Verify Device Preparation Group Targeting

Confirm that the authenticating user belongs to the User Group assigned to the Device Preparation Policy, and that your target security group has been assigned to receive configuration profiles and apps like Win32 app packages.

Production PowerShell Diagnostic Extraction

If error 80180003 persists after checking tenant scopes, pull the raw diagnostic bundle directly from the OOBE screen. Press Shift + F10 to launch Command Prompt, type powershell, and execute:

# Export comprehensive MDM & Autopilot diagnostic bundle
mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip "C:UsersPublicDocumentsAutopilotDiagnostics.zip"

Inspect the output in Event Viewer under:

• Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin: Review Event IDs 71, 76, and 11 for explicit token rejection errors.
• Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot: Track OOBE enrollment states and profile download status.

If you’re troubleshooting post-enrollment application packaging or script failures, check our in-depth reference on Intune Management Extension log files.

()

People Also Ask (PAA)

Why does Autopilot say “This user is not authorized to enroll” even with an Intune license?

The user account has a valid license, but your tenant is blocking the enrollment transaction. This happens when Entra join permissions are restricted to a specific pilot group, when personal Windows devices are blocked without Corporate Identifiers, or when the user has exceeded their maximum device quota.

Can I use Autopilot Device Preparation with Hybrid Entra Join?

No. Microsoft built Autopilot Device Preparation strictly for cloud-native Microsoft Entra Join. If your environment requires on-premises Active Directory domain joins, continue using Classic Windows Autopilot.

Do I need to upload hardware hashes for Autopilot Device Preparation?

No. Device Preparation works without collecting or uploading 4K hardware hashes. If your organization blocks personal device enrollment, upload the manufacturer, model, and serial number into Corporate Device Identifiers instead.

Summary Checklist

When you encounter Autopilot Device Preparation Error 80180003, work systematically: verify Entra join permissions, check MDM user scopes, clean up user device quotas, and add Corporate Identifiers if personal enrollments are blocked. Applying this framework turns random OOBE failures into a predictable, zero-touch provisioning workflow.