Basic troubleshooting of Wi-Fi device configuration profiles in Microsoft Intune

Steps

Step-by-Step Troubleshooting Guide

Note: Best practice is always factor in whether the issue is affecting one, a few or a large group. Is it a new configuration or something which recently stopped working. What recent changes have been made etc. Get the BIG picture, then drill down.

1. Verify Profile Assignment and Targeting
   • In the Microsoft Intune admin center, go to Devices > Configuration > Profiles.
   • Select your Wi-Fi profile > Assignments.
   • Confirm the profile is assigned to the correct user or device groups. Check for exclusions that might block deployment.
   • Use the Troubleshooting + support pane: Search for the affected user/device, then review the Assignments section to see if the profile is targeted correctly.
   • Common Issue: Profile shows "Not Applicable" or zero successes. Resolution: Adjust group membership or reassign. Monitor via Device and user check-in status > View report for success/error counts.
2. Check Device Sync and Enrollment Status
   • In Troubleshooting + support, select the device and verify Last check-in time (should be recent, e.g., within hours).
   • Ensure the device is enrolled and compliant: Under Device configuration, check status (e.g., "Succeeded" or "Pending").
   • Common Issue: Profile stuck in "Pending." Resolution: Force a sync on the device (Settings > Accounts > Access work or school > Info > Sync). If using Autopilot, re-enroll if enrollment type is incorrect (e.g., not Azure AD joined).
   • For Android Enterprise (Fully Managed or Dedicated), confirm no OS-specific bugs (e.g., Android 14 enrollment issues preventing Wi-Fi push).
3. Validate Dependencies (Certificates and Related Profiles)
   • If using certificate-based auth (e.g., EAP-TLS), ensure linked profiles like SCEP (for client certs) and Trusted Root (for server validation) are deployed.
     • Go to Devices > Configuration > Profiles and check their status on the device.
     • In the Wi-Fi profile settings, verify Root certificates for server validation points to the correct Trusted Root profile.
   • Common Issue: Cert mismatch (e.g., SN/SAN in SCEP not linking to AD objects). Resolution: Review SCEP config; test manual cert issuance. Update Wi-Fi profile's Certificate server names to match your CA's common names to bypass trust dialogs.
   • Manually connect to the Wi-Fi using a test cert with the same criteria. If successful, compare cert properties and update the profile accordingly.
4. Review Device-Side Logs
   • Windows:
     • Enable verbose MDM logging: Run reg add HKLM\SOFTWARE\Microsoft\OnlineManagement\Enrollments\<EnrollmentID>\DiagLog /t REG_DWORD /d 1 (replace <EnrollmentID> from registry).
     • Check Event Viewer: Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.
       • Filter for Event ID 1506 or keywords like "WiFiConfigurationServiceProvider" or "wifimgr".
       • Look for errors (e.g., "Node set value failed"); cross-reference timestamps.
     • Run netsh wlan show wlanreport for Wi-Fi auth details.
   • Android/iOS:
     • Use device logs (e.g., Android: adb logcat or Intune's built-in diagnostics).
     • Filter OMADM logs for Wi-Fi errors.
   • Common Issue: Logs show cert or auth failures. Resolution: Ensure RADIUS server logs show connection attempts; adjust EAP type or proxy settings.
5. Test and Isolate the Configuration
   • Create a test profile with minimal settings (e.g., just SSID and pre-shared key for WPA2-Personal) and assign to a single device.
   • Disable MAC randomization in the profile if privacy features interfere.
   • Common Issue: Errors like "WifiSharedKeyVersion" on shared-key profiles. Resolution: Verify password format (alphanumeric OK); test on a wired connection first.
   • For Enterprise Wi-Fi, prioritize cert auth over passwords for security.
6. Monitor Overall Profile Status
   • In Devices > Configuration > Profiles > [Your Profile] > Device status or User status.
   • Look for errors/conflicts; drill into per-device details.
   • Check Intune's Active alerts for service disruptions (e.g., past Android Wi-Fi sync issues).