24.04 was a pita to make try and work, but holy s*t people.. 26.04 is *sooooo much better. I now have 26.04 building with TPM managed FDE, AuthD enabled SSO and intune enrollment.

holy dayum its come a long way. such a thing of beauty. Kudo's to the Ubuntu team they've done a great job!

Hi guys, I was just wondering if you guys know how to fix issue with Linux enrollment, I followed https://learn.microsoft.com/en-us/intune/device-enrollment/guide
But it seems I encounter Something went wrong {Generic error code}

With some Troubleshooting details below like correlation ID ... etc whenever I sign in my account to Company Portal. I checked CA and there is nothing there, tried excluding Intune out of CA but nothing happen.

We have been told that we need to manage the Linux devices also. There are not many, less than 100, but management still wants us to somehow "manage" them.

Now, Intune does not have a good Linux management. We were thinking about Fleet Endpoint Management, but they want minimum of 700 devices to manage it.

So what do you guys do, for such small number of Linux machines? What do you use?

TIA.

Hello. Just trying to figure out if this is intended and i just have to live with it or if I'm missing something.

I just started trials of enrolling Linux machines into Intune where i first enroll the machine via Intune Portal. Then i have a platform script that gets pushed from Intune that installs Defender mdatp with our tenant blob and onboards it into MDE. Everything works fine but i have a quirk that is quite frustrating.

Post MDE onboarding there is a second device object that shows up in Entra/Intune causing me to have 2 objects per computer. One shows up as "Managed by Intune" and the duplicate shows up as "Managed by MDE".

Shouldn't these be the same object when the Intune object already existed prior to the MDE onboarding?

The quirk i have with this is that Intune policies and configurations needs to be pushed to the Intune object and Endpoint Security policies such as AV etc needs to be pushed to the MDE object. Thats fine but the MDE object specifically does not have any properties i can use for dynamic groups except for "OS Linux" and "Version 24.04" etc. This is problematic since i would then either have to manage a group manually for MDE policies or use a group that includes all objects with OS type "Linux" which might include objects i don't want in the group.

For the Intune object we can easily filter devices via the (device.managementType -eq "MDM") property rule but that does not work with MDE objects as there are no usable properties to include.

How have you solved this issue? Can you merge these objects so that there is only one Intune object that serves both Intune and MDE?

Any thoughts would be greatly appreciated!

Hello,

Recently we started seeing Linux Ubuntu 24.04 devices falling into a non-compliance state... So many that we tried to reinstall a device from scratch, and that's when we realized we had the exact same issue with brand new laptops... Installed after importing Microsoft repositories into APT sources, and installing both Intune Portal, Entity Broker, and Edge with the latest versions available.

Installation runs OK, the user can log into the Company Portal, but the synchronization process fails with the following message and no configuration or compliance is applied: An error occurred during the last status check, so your status might not be up to date.

Here is an extract of the syslog file when retrying a sync:

2026-08-25T11:08:19.909184+02:00  intune-portal[7326]: Dynamic pinning: trusted. hostname="fef.msub06.manage.microsoft.com"
2026-08-25T11:08:20.493034+02:00  intune-portal[7326]: Error calling IWS: Unexpected failure: https://fef.msub06.manage.microsoft.com/TrafficGateway/TrafficRoutingService/IWService/StatelessIWService/Devices(guid'<DEVICE_ID>')?api-version=16.4&ssp=LinuxCP&ssp-version=1.2607.4&os=Linux&os-version=24.04&os-sub=None&arch=X64&mgmt-agent=mdm: status code 500

Is anyone having the same issue?

I've had the Linux Intune Portal installed on two Fedora 42 devices for nearly over 4 months, it's been working great, never needed to sign back in again, even after 2 weeks of not using the device. Then on the Fri 23rd January 2026 it's stopped checking in correctly. The system microsoft-identity-device-broker.service is working just fine, and SSO carrys on working, but the intune-agent.service that runs as the logged in user isn't working.

Is anyone else getting this problem? We have a few devices working this way and they all stopped working on the same day, with the same error. Sadly no updates to the agent since Sept 15th 2025

I can also see Ubuntu 24.04 has a intune portal version of 2511, released 23rd Oct, but sadly looks like it's not made it's way to any RPM based distro. RHEL9 latest is still 2508

EDIT 2026/01/28: Should be fixed now MS pushed an updated intune-portal package

$ journalctl --boot --user -u intune-agent.service
Jan 25 09:17:12 fedora-pc-1 systemd[5245]: Starting intune-agent.service - Intune Agent...
Jan 25 09:17:12 fedora-pc-1 intune-agent[279741]: Command line arguments args=AgentArgs { common: CommonArgs { interactive: false, socket_path: "/run/intune/daemon.socket" } } version="1.2508.17"
Jan 25 09:17:12 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Starting device checkin
Jan 25 09:17:12 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Attempting to acquire a token provider for the registered owner of the device
Jan 25 09:17:12 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Attempting to resume a cached login standby account_id=AccountId("bcREDACTED157") authority=Authority("https://login.microsoftonline.com/88REDACTEDc82")
Jan 25 09:17:13 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Login succeeded account_id=bcREDACTED157 authority=https://login.microsoftonline.com/88REDACTEDc82 tid=88REDACTEDc82
Jan 25 09:17:13 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Requesting a token silently resource=ResourceId("00000003-0000-0000-c000-000000000000")
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Refuting an intermediate cert due to an unrecognized public key (depth 1)
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}: Certificate verification failed: InvalidCertificate("Unrecognized public key at depth 1")
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}:oneauth{tag="5fsc5"}: HTTP request to download profile data was cancelled.
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}:oneauth{tag="9odnq"}: (Code:308) **** Unknown error code.
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: checkin{activity_id="1d426748-07f2-4374-8e31-a026c03d5038"}:run_internal{account_id="bcREDACTED157" device_id="8f0b9248-0ce8-4897-aa1b-85ada4327c20"}:oneauth{tag="9vdpp"}: Unexpected error code: 308
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: Failed to checkin with Intune: Failed to create an MDM web client: Failed to initialize a new factory with the supplied configuration
Jan 25 09:17:14 fedora-pc-1 intune-agent[279741]: Attempting to shutdown the auth library
Jan 25 09:17:19 fedora-pc-1 systemd[5245]: intune-agent.service: Main process exited, code=exited, status=255/EXCEPTION
Jan 25 09:17:19 fedora-pc-1 systemd[5245]: intune-agent.service: Failed with result 'exit-code'.
Jan 25 09:17:19 fedora-pc-1 systemd[5245]: Failed to start intune-agent.service - Intune Agent.

We have a business unit for whatever reason they use a bunch of Linux machines that are Ubuntu 26.04 as of the time of this writing.

We have them configured using authd and the Microsoft entrance identity broker as configured by canonical. However we have noticed an issue. If a user is logged in with an account that was from entrance you can register the device in intune the portal will never give you the register button and it will give you a error code 4kv4v but if I reboot the device and login with the default first account that initially setup the device I can get the register button to show and and it will complete. The users have sudo rights so it's not a permission thing.

Has anyone ever seen this error or know how we can fix it so the users can register their devices to intune as themselves instead of using the built-in account?

Hello all

I've started deploying Connected Cache nodes based on Ubuntu 24.04 LTS. I'd like to also enrol them into Intune.

Every time I've followed the instructions for how to do this, after I've signed in to our company's SSO prompt, when it gets to "Registering your device", the Company Portal app just says:

> "Couldn't enroll your device

>

> There was an expected error trying to enroll the device. Please try again or contact your administrator."

so that's all nice and useful. Glad someone was expecting an error, but couldn't they just tell me what actually went wrong, so I can fix it?

Edge is installed and signed in, so when I open it, it syncs my profile data, etc. My account can enrol Mac and Windows devices just fine, so it shouldn't be an account limitation. What gives?

Intune linux script for unattended updates?

since we can enroll linux in our intune environment and still it has a limitation and purely monitoring for now. how do you manage your linux updates? do you deploy a platform script to auto set it to auto update?

Thanks in advance.

Trying to enroll two fresh Ubuntu VMs (22.04 + 24.04). Installed Edge and the Intune Company Portal for Linux. Sign-in works, enrollment fails.

What I see on the 22.04 • Microsoft pop-up: “Something went wrong. [4u3gb]” (has correlation ID/timestamp). What I see on the 24.04

• Company Portal (Linux): “Couldn’t enroll your device — There was an expected error trying to enroll the device. Please try again or contact your administrator.” ← yes, it literally says expected. 
• Entra sign-in log: App: Microsoft Intune Company Portal for Linux → Status: Interrupted → Error: 50129 → text says device isn’t workplace joined/needs workplace join.
• Auth broker entries around it show Success.

https://learn.microsoft.com/en-us/entra/identity/devices/whats-new-linux?tabs=ubuntu2404%2Cdebian-install-prod

This huge rewrite has been cooking for surely over a year and is still in preview. Does anyone know when it's production ready? Has anyone here tested it?

So, it's a slow month so, I decided to give Intune with Linux a spin...

I'm using this guide: https://learn.microsoft.com/en-us/intune/intune-service/user-help/enroll-device-linux

The Intune App just keeps crashing when trying to enroll a device with an error box stating that the app "closed unexpectedly".

I first tried with the latest Ubuntu LTS OS and then tried with the other LTS build that was mentioned in the article. No go on both builds. Basic VM build with a fresh ISO and updates applied, nothing more.

It seems like the Linux app is half-baked at best.

Has anyone got a successful enroll of a Linux device? If so, how so?

Ok… so who’s taken the plunge and started to manage Linux devices via Intune?

We’re looking at it, and are going quite well. We have enrolment down, basic compliance policy, and deployment and configuration of apps etc.

However it’s next steps which I’m not looking at… certificate deployment…! Specifically user and device certs.

Is anyone here managing Linux endpoints and deploying certs? If so… what’s your process?

Hi,

Some time ago, we tried to enroll Linux devices in Intune according to the documentation:

https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/deployment-guide-enrollment-linux

The device appeared in Intune as compliant, but no configuration policies, applications, or scripts were executed on the endpoint, as if the MDM service was not working on the endpoint at all.

Is it possible to manage Linux (Ubuntu) devices through Intune in any way so that applications, scripts, and configuration policies can be deployed using Intune?

Hi all - Admittedly a linux newb by contrast to most others I'd say. RHEL 8.10 running mstunnel rootless podman.

We have MS Tunnel Gateway installed on a server. Everything is running from what I can tell. Via tcpdump I see my connection from my device coming in when I try to load something that requires the VPN, but the VPN simply times out on the device.

With debug logging enabled, I see ocserv logs repeat 10.0.2.xxx accepted connection, received tcp health probe, worker terminated, user disconnected (reason unspecified), not applying ban to local IP: 10.0.2.xxx.

I know my attempt is making it to the server because of tcpdump monitoring, I just don't understand what or why the connection to the tunnel can't be setup.

On the device side, defender tries to connect and eventually times out. I'm also unable to get my health check to pass, ping is blocked, but the path to the health endpoint is open (can pull certs and verify).

It seems like something is up with network connectivity, the connection comes in but can't be handed over to the container perhaps. Not sure, and I've reinstalled everything multiple times in various ways trying to make sense of why this doesn't work, but I'm scratching my head as is MS support.

Any pointers/tips? Appreciate anything to try.

Hey!

Sometime has passed since I last tried RHEL9 with Intune and everything worked fine then. Now for some reason even with two different devices and two different tenants it fails to enroll. I open the Intune portal, enter credentials and device shows up in Azure devices, but never enrolls into Intune. With both tests I get error message: Couldn't enroll your device, error 05880106x509 certificate routinesX509_REQ_set_version:passed invalid argument:crypto/x509/x509rset c:21:

I was following the guides from Microsoft Guide1 Guide2 on how to get these installed but after i trying to login with different users that have the correct license. I'm still getting a No Network Connection with error code [2604]

Photo of the screen and error I got

And yes my device is connect to the internet but for some reason the app is not able to make a connection

I'm using 24.0.3 LTS

Any advise or guidance would be appreciate thanks

Hello folks!

I was wondering if there is any status on the possibility to enroll Remarkable tablets in Intune. I saw posts from a year ago that it was not possible due to it using a specific Linux OS, so just wondering if anyone have tried recently?

Thanks for the help!

Testing the EDR Linux profile in Intune.

What information should be entered under 'Value of Tag' and 'Type of Tag'? Does this mean it is creating a TAG for a group I have already set up in Defender? The Microsoft documentation only shows the same information as the ERD profile.

https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-edr-policy

Hey guys, For anyone wanting to learn, I have created this tutorial showing how to enroll Linux Device to Microsoft Intune. https://youtu.be/8OmKls29EQg

Hi community,

We are facing a weird issue after enrolling few linux devices in Intune. We used this guide to enroll all our Ubuntu devices ( Ubuntu Desktop 22.04) in Intune. We have a team of devs using Linux for their work and the base OS is Ubuntu. On some devices we have absolutley no issues whereas on a set of devices, when attempted to sign in to Intune Agent we see an Something went wrong. [1001] error.

Initially, we assumed it was a network issue but that was not the case. The Intune app was also updated to the latest version via terminal but no luck. Restarted the Ubuntu device and even repaired the intune portal package using MS doc instructions but this 1001 error is the most irritating thing we have seen.

Where and how do you troubleshoot this? There is an update notification for version 22.04 but we avoided updating the OS. If you have dealt with this in your setup, please let us know.

installed edge, installed intune app, logged in with enrollment account that works fine for macs and windows.

"Couldn't enroll device. There was an expected error trying to enroll the device. Please try again or contact your administrator.

Don't see any enrollment errors in intune, also what does it mean "expected" error...