I recently sat down to enrol a fleet of brand new corporate Android tablets into Microsoft Intune.
Everything was cruising along nicely until Intune stopped me in my tracks with a bizarre error message. What should have been a five minute job turned into a stubborn puzzle that cost me half my morning.
Picking the Right Enrolment Path
Before you hand out tablets to a team, you have to tell Intune how they will be used. Android gives you three basic flavours:
- Corporate-owned, fully managed: The company owns the hardware, one user logs in, and IT has full control. This was what I needed.
- Dedicated devices: Great for a front desk sign-in screen locked to one app, but useless for mobile staff.
- Work profile: Best for personal phones where you only want a tiny, secure work bubble.
I picked fully managed, set up my enrolment profile, and decided to do things properly. For a more detailed explanation of these please visit Android Management Options
A Quick Win: Naming Your Devices
Before touching the hardware, I always set up an automatic naming template. Leaving default device names makes your admin portal look like a junk drawer.
I used this handy format in the enrolment profile:
TAB-{{DEVICETYPE}}-{{SERIAL}}
This tags every tablet with its hardware type and unique serial number right out of the box. It makes finding a specific device later ridiculously simple.
Down the Rabbit Hole
Next, I wanted every new tablet to drop into a dedicated Entra ID security group automatically as soon as it enrolled. That way, all the apps and security policies apply without me lifting a finger.
I tried to save the profile, but Intune threw a giant warning at me:
“Before you configure device groups, make sure that the Intune Provisioning Client or Intune ClientConfidential app has been added as an owner.”
Fair enough, I thought. I jumped over to Entra ID, opened my tablet security group, clicked Owners, and searched for both names.
Nothing. The search box stared back at me, completely blank.
I figured the app was just hiding in the tenant. I opened Enterprise applications and searched for “Intune”, but the only thing that popped up was a PowerShell tool. Neither of the apps Microsoft explicitly told me to add actually existed under those names.
Cracking the Code
After twenty minutes of digging through documentation and banging my head against the desk, I realised Microsoft played a naming trick. The service principal is in your tenant, but its display name changes depending on how the tenant was set up.
The name is a red herring. The secret is finding it by its permanent Application ID:
f1346770-5b25-470b-88bd-d5744ab7952c
Once I stopped searching for names, fixing it took sixty seconds:
- Open Entra ID and head to Enterprise applications.
- Change the search filter to Application ID starts with and paste in
f1346770-5b25-470b-88bd-d5744ab7952c. - Check the name that appears. In my tenant, it was disguised as Intune Autopilot ConfidentialClient.
- Go back to your device group, click Owners, choose Add owners, and paste that exact name in.
As soon as that hidden app became an owner, Intune happily accepted the group and the tablets enrolled smoothly.
Save that Application ID in your notes. The next time Intune sends you on a wild goose chase, you can skip the headache and get right back to work.
Give it a spin on your next rollout and see what you think.
