You are unable to access Outlook/Teams from devices when you have Intune as your MDM with compliance policies added as well, when you check the servers your get this:
Click on one of the computers and then choose Device Compliance......
This will tell you where the device or server is failing compliance:
This means we are failing the "Default" compliance policy which means that the computer account is not synced to AAD from AD as it fails the "Is Active" and "Enrolled user exists"
This in turn will probably cause a conditional access policy to fail if its set like this:
dsregcmd /status
This will give you this:
+----------------------------------------------------------------------+
| Device State |
+----------------------------------------------------------------------+
AzureAdJoined : NO
EnterpriseJoined : NO
DomainJoined : YES
DomainName : BEAR
Device Name : SmallGrizzly.bear.local
+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
NgcSet : NO
WorkplaceJoined : YES
WorkAccountCount : 1
WamDefaultSet : NO
+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+
AzureAdPrt : NO
AzureAdPrtAuthority : NO
EnterprisePrt : NO
EnterprisePrtAuthority : NO
+----------------------------------------------------------------------+
| Work Account 1 |
+----------------------------------------------------------------------+
WorkplaceDeviceId : <Workplace ID>
WorkplaceThumbprint : <work thumbprint>
DeviceCertificateValidity : [ 2023-07-21 09:46:50.000 UTC -- 2033-07-21 10:16:50.000 UTC ]
KeyContainerId : 2633fb63-78f0-4ebd-9d11-a866e95276cc
KeyProvider : Microsoft Software Key Storage Provider
TpmProtected : NO
WorkplaceIdp : login.windows.net
WorkplaceTenantId : <Tenant ID>
WorkplaceTenantName : Magical World of Bears
WorkplaceMdmUrl :
WorkplaceSettingsUrl :
NgcSet : NO
+----------------------------------------------------------------------+
| Diagnostic Data |
+----------------------------------------------------------------------+
Waiting for Diagnostics Task to complete. This could take a few minutes...
Diagnostics Reference : www.microsoft.com/aadjerrors
User Context : SYSTEM
Client Time : 2023-07-21 10:33:43.000 UTC
AD Connectivity Test : PASS
AD Configuration Test : PASS
DRS Discovery Test : PASS
DRS Connectivity Test : PASS
Token acquisition Test : SKIPPED
Fallback to Sync-Join : ENABLED
Previous Registration : 2023-07-21 10:23:50.000 UTC
Registration Type : sync
Error Phase : join
Client ErrorCode : 0x801c03f3
Server ErrorCode : invalid_request
Server ErrorSubCode : error_missing_device
Server Operation : DeviceRenew
Server Message : The device object by the given id (93f2d808-3f8c-4319-9443-f10540464f0a) is not found.
Https Status : 400
Request Id : 686ae643-cc83-4c76-b751-6c954637af60
+----------------------------------------------------------------------+
| IE Proxy Config for System Account |
+----------------------------------------------------------------------+
Auto Detect Settings : YES
Auto-Configuration URL :
Proxy Server List :
Proxy Bypass List :
+----------------------------------------------------------------------+
| URL Specific Proxy Config |
+----------------------------------------------------------------------+
Auto Detect PAC Status : Failed to auto detect the Proxy Auto-Configuration (PAC) script using WPAD. code: 0x80072f94
Executing Account Name : <NETBIOS name>$, <UPN Name>
+----------------------------------------------------------------------+
| IE Proxy Config for Current User |
+----------------------------------------------------------------------+
Auto Detect Settings : NO
Auto-Configuration URL :
Proxy Server List :
Proxy Bypass List :
+----------------------------------------------------------------------+
| WinHttp Default Proxy Config |
+----------------------------------------------------------------------+
Access Type : DIRECT
+----------------------------------------------------------------------+
| Ngc Prerequisite Check |
+----------------------------------------------------------------------+
IsDeviceJoined : NO
IsUserAzureAD : NO
PolicyEnabled : NO
PostLogonEnabled : YES
DeviceEligible : NO
SessionIsNotRemote : NO
CertEnrollment : none
PreReqResult : WillNotProvision
However we need to look at the error which is this:
Server Message : The device object by the given id (93f2d808-3f8c-4319-9443-f10540464f0a) is not found.
This means that the object in your AD is not synced to AAD from AD and needs to be, so you will need to add this OU to the sync list (this usually only applies when you are selective with what is synced to AAD)
If you do a metaverse search for the device with the displayName of the device name, you will notice nothing is returned....as below:
Once you have added the OU from PowerShell you will need to complete a full sync using this command:
Start-ADSyncSyncCycle -PolicyType Initial
Once that completes if you run the same search in Metaverse you will notice you now get some results....
Once they are all listed, Hybrid Join will take care of iteself after a moment or two but if you are impatient you can do this:
Reregister Basic Steps
Start a command prompt (elevated)
dsregcmd.exe /debug /leave
Sign out and sign in back to the device to complete the recovery.
dsregcmd.exe /debug /join
Reregister Force Recovery Method
If you will get no dice you need to force a recovery like this:
Start a command prompt (elevated)
dsregcmd /forcerecovery
Click "Sign in" in the dialog that opens up
Continue with the sign in process.
Sign out and sign in back to the device to complete the recovery.
Then when you get the workplace join status you will notice all is well with the report, the command to check the status is:
dsregcmd /status
This should return something like this:
That now completes the registration and the dsregcmd join, however are you will getting errors about compliance ????
Compliance says, NO
Click the more details then the copy info to clipboard and you will get this:
This will then give you the reason why, which is 53000 which means that a Conditional Access policy requires a compliant device, and the device is not compliant. Have the user enrol their device with an approved MDM provider like Intune.
This means the policy is now being blocked by "non compliant" users policy, so if you cannot get the computer compliant for one reason or another in conditional access you need to exclude the user, so lets find the policy causing this it will look like this:
Then you need to exclude that user from conditional access to get the connection working.....
MFA was unhappy
(invoke-restmethod -Uri ("https://endpoints.office.com/endpoints/WorldWide?ServiceAreas=MEM`&`clientrequestid=" + ([GUID]::NewGuid()).Guid)) | ?{$_.ServiceArea -eq "MEM" -and $_.ips} | select -unique -ExpandProperty ips
(invoke-restmethod -Uri ("https://endpoints.office.com/endpoints/WorldWide?ServiceAreas=MEM`&`clientrequestid=" + ([GUID]::NewGuid()).Guid)) | ?{$_.ServiceArea -eq "MEM" -and $_.urls} | select -unique -ExpandProperty urls