Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If the Intune Company Portal app rejects a valid work account, repeatedly returns to the sign-in screen, or shows Login error occurred, do not assume that your password is the problem. The failure may be in the Company Portal package, Windows Web Account Manager, a proxy or VPN, Microsoft Entra device registration, Intune enrollment, Conditional Access, compliance, licensing, or the Microsoft service itself.
The safest troubleshooting order is: test the Company Portal website, check service and network conditions, update or repair the Windows app, inspect Settings > Accounts > Access work or school, then use dsregcmd /status and administrator-side sign-in logs to identify the remaining cause. Resetting or reinstalling Company Portal can repair local app state, but it cannot fix an invalid license, an enrollment restriction, a noncompliant device, or a Conditional Access policy.
First identify which part of Company Portal is failing
Use the symptom that most closely matches your experience. This prevents you from repeatedly reinstalling an app when the real problem is an account or tenant policy.
| What you see | Most likely problem area |
|---|---|
| Company Portal will not open | Microsoft Store, the MSIX app package, Windows permissions, security software, or a damaged app registration |
| The app opens but sign-in loops or returns to the login screen | Windows Web Account Manager, stale token state, proxy or TLS inspection, VPN interference, or Conditional Access |
| The browser works but the Windows app does not | Usually local Windows authentication infrastructure, the app package, or a proxy treating browser and non-browser traffic differently |
| The browser and the app both reject the account | Account, password, MFA, tenant, Conditional Access, service outage, or network access |
| Sign-in succeeds but setup or enrollment fails | Intune license, enrollment restriction, duplicate device, MDM configuration, administrator rights, or an existing management provider |
| The device appears but company resources remain blocked | Compliance, stale device registration, failed check-in, or a Conditional Access policy |
| You can sign in but no apps appear | App assignment, device identification, primary-user information, synchronization, platform compatibility, or a known Intune app-visibility issue |
Company Portal enrollment is more than a login. In Microsoft’s current Windows flow, you sign in, select Next, select Connect, authenticate again, select Go, return to Company Portal, and select Next and Done. A successful password prompt therefore does not prove that Windows registered the device or that Intune accepted the enrollment.
#1 Best Overall
- 【4 Ports USB 3.0 Hub】Acer USB Hub extends your device with 4 additional USB 3.0 ports, ideal for connecting USB peripherals such as flash drive, mouse, keyboard, printer
- 【5Gbps Data Transfer】The USB splitter is designed with 4 USB 3.0 data ports, you can transfer movies, photos, and files in seconds at speed up to 5Gbps. When connecting hard drives to transfer files, you need to power the hub through the 5V USB C port to ensure stable and fast data transmission
- 【Excellent Technical Design】Build-in advanced GL3510 chip with good thermal design, keeping your devices and data safe. Plug and play, no driver needed, supporting 4 ports to work simultaneously to improve your work efficiency
- 【Portable Design】Acer multiport USB adapter is slim and lightweight with a 2ft cable, making it easy to put into bag or briefcase with your laptop while traveling and business trips. LED light can clearly tell you whether it works or not
- 【Wide Compatibility】Crafted with a high-quality housing for enhanced durability and heat dissipation, this USB-A expansion is compatible with Acer, XPS, PS4, Xbox, Laptops, and works on macOS, Windows, ChromeOS, Linux
Follow these low-risk fixes first
1. Confirm the account and complete every authentication prompt
- Use the organization’s work or school account, including the correct user principal name (UPN), rather than a personal Microsoft account.
- Try signing in to Microsoft 365 or portal.manage.microsoft.com from the same Windows computer.
- Complete MFA, number matching, a security-key prompt, password reset, or Windows Hello verification if requested.
- If your organization uses more than one Microsoft 365 tenant, verify that the account belongs to the tenant managing this device.
A browser sign-in only confirms that the browser authentication path worked. Company Portal is a Windows application and can depend on Windows’ authentication broker, device registration, enrollment state, and tenant policy even when the same account works in a browser.
2. Test the website before changing the computer
Open the Company Portal website on the affected PC. Also try another browser, and—if your organization permits it—another device or network.
- Website and app both fail: prioritize the account, tenant, network, Conditional Access, or Microsoft service.
- Website works but the app fails: prioritize Company Portal, Web Account Manager, Windows account state, Store components, and proxy treatment of app traffic.
- Website works and the app signs in but enrollment fails: move to the enrollment and administrator checks later in this article.
3. Check date, time, network, VPN, and proxy settings
Incorrect system time can invalidate authentication tokens. Confirm that Windows has the correct date, time, time zone, and automatic time synchronization. Then temporarily disconnect a user VPN only if your organization’s policy allows it and test again.
If possible, test on a trusted phone hotspot. If Company Portal works there but not on the normal network, ask IT to investigate the proxy, secure web gateway, DNS, firewall, VPN, tenant restrictions, or TLS/SSL inspection. Do not permanently disable enterprise security controls or create a blanket firewall bypass just to make enrollment work.
Microsoft’s current Intune network endpoint documentation identifies traffic that may require unauthenticated proxy access, including manage.microsoft.com, *.azureedge.net, and graph.microsoft.com. Microsoft also states that SSL inspection is unsupported for specific endpoint groups, including *.manage.microsoft.com, *.dm.microsoft.com, and listed Device Health Attestation endpoints. The exact allowlist changes, so administrators should use that current endpoint page rather than an old script or copied list.
For a basic DNS check, run these commands in Command Prompt:
nslookup login.microsoftonline.com
nslookup enterpriseregistration.windows.netSuccessful DNS resolution does not prove that proxy authentication, TLS inspection, firewall access, or Conditional Access is correct. It only shows that DNS answered the query. Microsoft identifies enterpriseregistration.windows.net as an important device-registration endpoint; timeouts, connection-aborted errors, or name-resolution failures to it point toward the registration path rather than a bad Company Portal password.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems4. Check for a Microsoft or tenant-wide incident
Ask whether other employees or students are seeing the same error. An administrator should check:
- Intune admin center > Tenant administration > Tenant status > Service health and message center
- Microsoft 365 admin center > Health > Service health
The Intune tenant status page reports incidents and advisories affecting the tenant. Access to service-health information requires an appropriate administrator or service-health role. If several users fail at the same time, wait for the incident information or contact IT rather than making destructive changes to individual devices.
Update Windows, Microsoft Store, and Company Portal
Install pending Windows updates first if your organization permits it, then update Microsoft Store applications. Microsoft’s documentation currently lists Company Portal for Windows version 11.1.254.0 as the minimum supported version. That is a minimum supported version, not a claim that it is the latest Store release.
- Open Microsoft Store.
- Select Downloads.
- Select Get updates.
- Restart Company Portal, or restart Windows if the Store reports that a restart is needed.
- In Company Portal, open Devices, select the affected device, and choose Check access.
Use Microsoft’s Company Portal update instructions if the labels differ on your Windows build.
Recommended Free Tools
If Microsoft Store will not open
Press Windows key + R, enter the following command, and press Enter:
wsreset.exeMicrosoft says this clears the Store cache, closes the temporary command window, and normally reopens Microsoft Store automatically. Then return to Microsoft Store > Downloads > Get updates. Also check Microsoft’s Microsoft Store troubleshooting guidance for Windows updates, time and location settings, and Store repair options.
Rank #2
- The Anker Advantage: Join the 80 million+ powered by our leading technology.
- SuperSpeed Data: Sync data at blazing speeds up to 5Gbps—fast enough to transfer an HD movie in seconds.
- Big Expansion: Transform one of your computer's USB ports into four. (This hub is not designed to charge devices.)
- Extra Tough: Precision-designed for heat resistance and incredible durability.
- What You Get: Anker Ultra Slim 4-Port USB 3.0 Data Hub, welcome guide, our worry-free 18-month warranty and friendly customer service.
Repair, reset, or reinstall Company Portal
These steps address local app corruption or a broken app package. They do not correct tenant policies, licensing, device compliance, or a blocked enrollment.
Windows 11
- Open Settings.
- Select Apps > Installed apps.
- Find Company Portal.
- Select its three-dot menu, then Advanced options.
- If available, select Terminate to close the app completely.
- Select Repair.
- Restart Company Portal and test the sign-in.
- If Repair does not help, return to the same screen and select Reset.
Windows 10
- Open Settings.
- Select Apps > Apps & features.
- Select Company Portal, then Advanced options.
- Select Repair.
- If Repair does not help, select Reset.
- Restart Windows and test again.
According to Microsoft’s Windows app repair guidance, Repair attempts to fix the application without removing its data. Reset removes the app’s local data and gives it a fresh local state, so you may need to sign in again.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Resetting Company Portal is not the same as unenrolling the PC. It can remove the app’s local data, but it does not universally repair Microsoft Entra registration, Intune enrollment, or Conditional Access. Do not interpret a successful reset as proof that device management is healthy.
Reinstall Company Portal
If Repair and Reset fail:
- Uninstall Company Portal from Settings > Apps.
- Restart Windows.
- Install the Store version again.
- Sign in with the organization account and complete the device setup flow if prompted.
The recommended source is the official Company Portal listing in Microsoft Store. Microsoft also provides a Company Portal download package for organizational deployment when Store access is unavailable. That package is primarily intended for deployment and is not necessarily the newest Store release.
For administrator-controlled downloading, Microsoft documents:
winget download "Company Portal" --source msstoreSee Microsoft’s manual Company Portal deployment instructions before deploying the package across managed computers.
Fix a sign-in loop by checking Windows Web Account Manager
Web Account Manager (WAM) is the Windows authentication broker used by modern Windows applications. If Company Portal, Microsoft Store, Office, OneDrive, Teams, or another Microsoft app has trouble signing in, the common failure may be in this shared Windows authentication layer rather than in Company Portal alone. Microsoft describes WAM in its Web Account Manager documentation.
Repair the work-account broker package
Sign in as the affected Windows user, open PowerShell as administrator, and run the Microsoft-documented command:
if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) {
Add-AppxPackage -Register "$env:windir/SystemApps/Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy/Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
}
Get-AppxPackage Microsoft.AAD.BrokerPluginRestart Windows after the command completes. Test Microsoft Store, the Company Portal website, and then the Company Portal app. If an account prompt appears, choose the organization account rather than a personal Microsoft account.
This command repairs or registers the work-account broker package when Windows does not find it. It is not a general repair for every authentication failure. Microsoft’s automatic authentication troubleshooting documentation also describes a separate Microsoft.Windows.CloudExperienceHost repair for personal Microsoft accounts; that is generally not the relevant package for a work-account Company Portal problem.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Clear corrupted broker account data only as an escalation
Close Company Portal and other Microsoft applications before touching the broker cache. Microsoft troubleshooting guidance identifies this folder:
%LOCALAPPDATA%PackagesMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewyACTokenBrokerAccountsAs an escalation step, the contents can be cleared according to Microsoft’s guidance. When practical, rename or back up the folder first. Clearing it can sign you out of Office, OneDrive, Teams, Microsoft Store, and other Microsoft applications, so expect to authenticate again.
Do not make registry permission changes as a routine first-line fix. Microsoft documents registry and permission remediation for specific 0xCAA5001C and Event ID 1098 scenarios. Use the Event 1098 token-broker guidance, and involve IT on a managed computer.
Rank #3
- 【Plug and Play】No software, drivers or complicated installation process requirement
- 【USB Expansion】This USB Hub tansfer a single USB port into 4 USB data ports. you can get 1 USB 3.0 and 3 USB2.0 ports with your new USB C laptop
- 【Wide Compatibility】This USB adapter has a wide range of compatibility, including USB cables, flash drives, mice, keyboards. Also works with hubs for MacBook Pro 2021/2020/2019, Google Chromebook Pixelbook, Samsung series and laptops and more USB Type-C devices (charging not supported)
- 【4 in 1 USB Hub】USB Hub Multiport Adapter contains 1*USB 3.0 and 3*USB 2.0,supports super faster data transfer up to 5Gbps which is 10X faster than USB 2.0 (480 Mbps), which allows you to transfer datas in just seconds; USB extension hub was built in OTG function chip, it can easily connect the mouse, keyboard, USB disk, and other USB devices to your USB-C phones and tablets
- 【Easy to Carry】The USB extension cable multiple port has been Special designed to be as slim and light as possible, ideal for your working and traveling with ultrabook. easy to store and use
Check Microsoft Entra registration with dsregcmd /status
Run the command in a normal, non-elevated Command Prompt under the affected user account:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
dsregcmd /statusMicrosoft specifically recommends the user context when reviewing WAM and Primary Refresh Token information. Use the Microsoft dsregcmd troubleshooting reference for the full output.
Review Device State
AzureAdJoined : YESmeans the PC is Microsoft Entra joined.DomainJoined : YEStogether withAzureAdJoined : YESindicates a Microsoft Entra hybrid-joined device.WorkplaceJoinedrepresents a Microsoft Entra registered user state.
The correct state depends on how your organization manages the PC. A personal device may be registered, while a corporate device may be joined or hybrid joined. Do not change the state simply because it does not match another computer.
Review User State
WamDefaultSet : YESis expected when a default WAM account is functioning.WamDefaultAuthority : organizationsis expected for organizational Microsoft Entra authentication.WamDefaultId : https://login.microsoft.comis the Microsoft Entra WAM authority identifier documented by Microsoft.
Review SSO State and the PRT
AzureAdPrt : YESindicates that a Primary Refresh Token is present.AzureAdPrt : NOindicates a problem acquiring the PRT and can explain repeated authentication prompts.
If the PRT update time is more than four hours old, Microsoft recommends locking and unlocking the computer to force a refresh, then running dsregcmd /status again. Check the network, time, MFA, device registration, and Conditional Access if the value remains NO.
Do not run dsregcmd /leave as a generic fix. On a managed PC it can remove or disrupt device registration and may require re-enrollment. Use it only when your organization explicitly directs the procedure.
Inspect Windows event logs for broker and registration errors
For authentication-broker problems, open Event Viewer and look under:
Event Viewer
> Applications and Services Logs
> Microsoft
> Windows
> Microsoft Entra ID or AAD
> OperationalThe exact display name can vary by Windows build. Look for Event ID 1098, 0xCAA5001C, 0xCAA82EE2, token-broker failures, timeout or nonce errors, and correlation or request IDs.
For device-join and registration failures, inspect:
Event Viewer
> Applications and Services Logs
> Microsoft
> Windows
> User Device RegistrationMicrosoft points to User Device Registration events, including Event ID 204 in relevant Windows 10 troubleshooting scenarios. Save the event details rather than relying on a screenshot of only the headline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check Access work or school before removing anything
Open:
- Windows 11: Settings > Accounts > Access work or school
- Windows 10: Settings > Accounts > Access work or school
Look for the intended organization account, duplicate connections, an old employer or school tenant, a message that the device is already managed, or a connection belonging to another Windows user.
Before selecting Disconnect, determine whether the computer is corporate-owned or personal and whether it is Microsoft Entra joined, hybrid joined, registered, managed by Intune, managed by Configuration Manager, or controlled by another MDM. Removing a work or school connection can affect certificates, device registration, compliance, access, and management. On a corporate computer, get IT approval first.
Resolve “device already enrolled” and other enrollment errors
Authentication and enrollment are separate stages. If you can sign in but setup fails, use the error code and message to identify the correct owner. Microsoft’s Windows enrollment error reference documents these common cases:
| Error or message | Likely cause | Who should fix it |
|---|---|---|
0x8018000A“The device is already enrolled” |
Another user has already enrolled or joined the device. | IT or the authorized device owner. The other user may need to remove the work or school connection, sign out, and allow the intended user to enroll. |
0x8007064C“The machine is already enrolled” |
Prior enrollment, a cloned image from an enrolled PC, or a stale account certificate. | IT or an administrator. Certificate and enrollment-artifact cleanup is not a normal end-user step. |
0x80180014 |
Windows MDM enrollment is disabled or blocked by an enrollment restriction. | Intune administrator. |
0x80180026 |
A legacy Intune PC agent conflicts with automatic MDM enrollment. | IT or the administrator managing the old agent. |
| “This account is not allowed…” | The user may lack an Intune license or an eligible Microsoft 365 license. | Microsoft 365 or Intune administrator. |
| “We couldn’t auto-discover a management endpoint…” | Incorrect account, tenant discovery, or management endpoint configuration. | User verifies the account first; IT corrects tenant or endpoint configuration. |
| “Your device is already being managed by an organization” | Existing Intune, Configuration Manager, or third-party MDM management. | IT or the existing management provider. |
| “You don’t have the right privileges…” | The configured Windows device requires local administrator rights for that enrollment path. | IT or an administrator. |
A configured Windows PC may require the enrolling user to be a local administrator for a particular Company Portal method. Microsoft notes that Windows Autopilot and enrollment of a brand-new device use the local system account and can avoid that requirement. See Microsoft’s guidance on permission to enroll Windows devices.
Rank #4
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Do not delete enrollment certificates, registry values, or the entire HKLMSOFTWAREMicrosoftEnrollments branch from an internet checklist. Cloned images and stale enrollment artifacts sometimes require administrator cleanup, but removing the wrong object can damage the management state and leave the PC neither correctly enrolled nor safely unenrolled.
If sign-in works but the device is not ready or compliant
In Company Portal, open Devices, select the affected device, and under Device status select Check access. Apply the remediation shown, wait several minutes for synchronization, and select Check access again.
Microsoft documents three possible results in Check device access for Windows:
- Can access company resources
- Cannot access company resources
- Can access company resources, but action required
Depending on your organization’s policies, the required actions may involve:
- A supported Windows edition and build.
- Antivirus or anti-malware protection.
- Microsoft Defender Firewall.
- Secure Boot or Code Integrity.
- Password, UAC, or account-security settings.
- Encryption.
- An approved network connection.
These requirements are tenant-specific. Do not assume that every Intune organization requires BitLocker, Secure Boot, Microsoft Defender, a particular antivirus, or one specific Windows build. The Company Portal Windows device-requirements documentation explains that the organization’s compliance policies determine what must be corrected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If Company Portal shows no available apps
Missing apps after a successful login are not necessarily a login failure. Check the device identity and assignment instead.
For a documented Windows 10 app-visibility case, sign in to portal.manage.microsoft.com, open My Devices, follow the device-identification prompt, select the affected device, and return to the Apps page. Microsoft describes this workaround in its guidance for apps that do not appear as Available.
An administrator should also verify:
- The app is assigned to the correct user or device group.
- The device has the correct primary user.
- The device has checked in recently.
- The user is signed in to the correct tenant.
- The app supports the device’s Windows version, architecture, and ownership type.
- Required apps have finished processing.
- Configuration Manager applications are not simply still loading.
Microsoft’s Intune known-issues page also lists situations involving slow Configuration Manager app loading, missing Azure enterprise applications, and incomplete Windows build ranges in some remediation messages. If the assignment is correct but the portal remains empty, IT should compare the device record, primary user, check-in time, and current service advisories.
Recommended Free Tools
What the administrator should check
Microsoft Entra sign-in logs
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs. Filter by the affected user and application, then record:
- Failure reason and sign-in error code.
- Conditional Access result and the policy that blocked or interrupted the request.
- Correlation ID and request ID.
- Username and tenant.
- Exact timestamp and time zone.
- Device, browser, client-app, network, and location information shown in the event.
Microsoft’s sign-in error troubleshooting documentation specifically recommends using the error code, failure reason, correlation ID, username, and timestamp when investigating authentication failures.
Intune and tenant configuration
Check the user’s Intune or eligible Microsoft 365 license, MDM user scope, Windows enrollment restrictions, device limits, device-platform restrictions, enrollment-manager configuration, Conditional Access requirements, compliance policies, and duplicate or stale device records. Also check whether the computer is already controlled by another MDM or Configuration Manager.
Conditional Access can create an apparent login loop when access requires a compliant or registered device while the device is still being enrolled. That situation requires an administrator to review the policy result and enrollment design; reinstalling Company Portal will not resolve the policy conflict.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Company Portal logs
If Company Portal opens, select Help & support > Upload logs, describe the exact failure, and send the generated message to the help desk. Microsoft says the logs can also be shared with Microsoft Support when the organization escalates the incident.
Best Value
![VIENON 4-Port USB 3.0 Hub [90°/180° Degree Rotatable], USB Splitter with PD-in 5W USB C Port, USB Extender for Laptop, Car, iMac, MacBook Air, MacBook Pro, and More](https://m.media-amazon.com/images/I/31KyAOXX0TL._SL160_.jpg)
- 【USB Port Expander】：This 4-Port USB hub can easily expand one of your computer’s USB ports into 3 USB port and 1 Type C port. Support 4 ports to work at the same time, without any pressure, and keep the temperature in the middle range. Plug and play, no need driver, easy to use.
- 【USB C Power & Data Port】: The USB C female port supports 5V Power supply for the hub, as well as the data transfer, which allowing you to connect to Type C phones, mobile hard drives, and other devices for data transfer has solved the problem of your laptop and computer lacking USB C interfaces. (Note: this usb c port only support power input for the hub, not support power output for charging).
- 【Wide Application】: Ideal for Mac Pro, iMac, MacBook Air, MacBook Pro, MacBook, and Mac mini. And this is also very suitable for use in the car. It extends the USB interface in the car, compatible with esla Model Y 2021-2024 and Model 3 2021-2023 and other Car. (Note: not support audio & video transfer, not compatible with any sound devices)
- 【SuperSpeed Transmission】：With 1 x USB 3.0 port and 2 x USB 2.0 ports. The USB 3.0 interface has a data transfer speed of up to 5Gbps, and can download a high-definition movie in just a few seconds. It is very suitable for inserting USB drives, mobile hard drives, cameras, and other devices for fast data transfer. Two USB 2.0 interfaces with a speed of 480Mbps, suitable for inserting USB peripheral devices such as mice, keyboards, printers, etc.
- 【Plug & Play】: Support hot-swappable on Windows 7/ Vista/ XP/ 2000/ ME/ 98/ 8/ 10; Mac OS 8.6-9.2/ OSX-10.6, and Linux.
If the app cannot be used, collect the files from:
%LOCALAPPDATA%PackagesMicrosoft.CompanyPortal_8wekyb3d8bbweLocalStateCompany Portal log files use the Log_<n>.log naming pattern. Do not edit the files before sending them, but redact passwords, tokens, personal information, and unrelated sensitive data where appropriate.
Send this information to the help desk
A complete handoff is much more useful than “Company Portal does not work.” Copy this checklist and fill it in:
Windows edition and build:
Company Portal version:
Exact error text:
Error code:
Date, time, and time zone:
Does https://portal.manage.microsoft.com/ work?:
Do Microsoft Store, Office, OneDrive, or Teams sign in?:
Does another browser work?:
Does another network work?:
AzureAdJoined:
DomainJoined:
WorkplaceJoined:
WamDefaultSet:
AzureAdPrt:
Microsoft Entra correlation ID:
Intune device name and device ID:
Device status and Check access result:
Company Portal logs attached:Include whether the device is corporate-owned or personally owned, whether another Windows user previously used it, and whether the computer was recently reimaged, cloned, upgraded, or moved between accounts or tenants. These details can immediately distinguish stale enrollment from a local app failure.
Free tools Windows power users keep installed
One-click scans. No signup required.
When to stop troubleshooting locally
Contact IT rather than continuing with resets or registry changes when:
- The device is corporate-owned or required for work.
- Windows says the device is already managed or enrolled.
- You are being asked to disconnect a work or school account.
- The error involves enrollment certificates, registry keys, or a cloned image.
- Licensing, Conditional Access, MDM scope, or enrollment restrictions may be involved.
- Your organization uses a proxy, tenant restrictions, TLS inspection, Configuration Manager, or a third-party MDM.
- You could lose access to company resources by changing device registration.
Windows 10 versus Windows 11 support
The general troubleshooting path is similar, but Settings labels differ: Windows 11 uses Apps > Installed apps, while Windows 10 uses Apps > Apps & features.
Windows 10 reached end of support on October 14, 2025. Microsoft’s current Intune enrollment documentation says Windows 10 enrollment may still be allowed, but functionality is not guaranteed and can vary. If the hardware and organizational policy permit it, moving to a supported Windows 11 release is the safer long-term option. An upgrade alone, however, is not a substitute for checking enrollment, compliance, licensing, and Conditional Access when those are the actual cause.
Frequently Asked Questions
Why does Company Portal work in a browser but not in the Windows app?
The browser and Windows app use different authentication paths. Company Portal can depend on Web Account Manager, the Microsoft.AAD.BrokerPlugin package, Windows account state, device registration, and proxy rules that affect non-browser traffic. Repair or reset the app, check the broker, and run dsregcmd /status before assuming the account is invalid.
Will resetting Company Portal unenroll my Windows computer?
No. Resetting the app removes its local data and may require another sign-in, but it is not the same as removing Intune enrollment. It also cannot fix licensing, Conditional Access, compliance, or tenant enrollment restrictions.
Should I disconnect the work or school account to fix Company Portal?
Not without approval on a managed computer. Disconnecting can affect Microsoft Entra registration, certificates, compliance, access, and management. It is appropriate only in specific duplicate or stale-account scenarios, normally with IT guidance.
What does AzureAdPrt : NO mean?
It means Windows does not currently have a usable Microsoft Entra Primary Refresh Token for that user session. Lock and unlock the PC to prompt a refresh, then check the network, time, MFA, device registration, and Conditional Access if the value remains NO.
Why can I sign in but still see no Company Portal apps?
Authentication may have succeeded while app assignment or device identification has not. Check the device in the Company Portal website, then have IT verify the user or device assignment, primary user, recent check-in, correct tenant, platform compatibility, and current Intune issues.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe Bottom Line
Start with the Company Portal website and service/network checks, then update, repair, reset, or reinstall the Windows app. If the browser works but the app loops, investigate Web Account Manager and dsregcmd /status. If sign-in succeeds but enrollment, compliance, or app visibility fails, the fix is usually in Intune or Microsoft Entra—not in another app reinstall. Avoid disconnecting managed accounts, deleting enrollment artifacts, changing registry permissions, or running dsregcmd /leave unless your organization directs the action.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
