Windows MDM - Device Enrollment Failing
Postmortem
Incident Report
Date: Sep 13, 2025
Date of Incident: Sep 10, 2025
Description: RCA for Windows MDM enrollment failures
Summary:
On September 10, 2025, a number of customers experienced intermittent failures when attempting to enroll Windows MDM devices. User-led enrollments during this period would have seen an error message.
Root Cause:
Our MDM team was alerted to an issue with our MDM certificate issuance service, which affected the ability to enroll devices. This issue was caused by a configuration change in our backend infrastructure.
The core problem stemmed from an update that inadvertently caused a critical service role to be deleted and immediately recreated. When this happened, our IaaS provider assigned the recreated role a new, unique ID. Our system, which was configured to recognize the old ID, was no longer able to access the necessary security keys. This caused certificate issuance to fail, causing the MDM enrollment failures.
Corrective Actions / Risk Mitigation:
- Implemented a permanent fix refactoring our infrastructure for this service - DONE
- Refining our emergency response plan to securely restore services - IN PROGRESS
- Updating our monitoring systems to proactively detect and alert on these types of issues, including reconfiguring our logging to ensure that critical errors are not missed - IN PROGRESS