Fixing Azure AD Device Join Error: We Can't Connect to the URL for Your Organization's MDM Terms of Use

This is how to fix the error when attempting to join a device to Microsoft Entra ID (formerly Azure AD), for instance by signing in during the Windows OOBE (out of box experience) using a Microsoft work or school account.

Something went wrong.
Looks like we can’t connect to the URL for your organization’s MDM terms of use. Try again, or contact your system administrator with the problem information from this page.

Cause

This issue occurs because the user does not have an Intune license, and at the same time as joining Entra ID (formerly Azure AD) it’s trying to enroll the machine in Intune MDM. The fix is to therefore stop it from trying to enroll the user, however if your admin account does not have a license you won’t be able to do this. You can therefore fix the issue by getting a trial license of any license containing Microsoft Entra ID P1 (formerly Azure AD Premium P1), and configuring MDM enrollment settings in Microsoft Entra ID.

Fix

The fix is to configure the MDM User Scope in Microsoft Entra ID, depending on whether you want devices to automatically enroll in Intune or not.

Log on to https://portal.azure.com with a Global Admin account
Search for MDM, and open Mobility (MDM and MAM) (or find this under Microsoft Entra ID)

Select Microsoft Intune (or similar)

If your admin account does not have a license you may see the following error (if not you don’t need to get a temporary license).

Obtaining a License

So, we can get a trial license for free (assuming you have not used all your trials for everything).

Go to https://admin.microsoft.com/
Get a trial for Microsoft Entra ID P1 (any product containing this should also be OK)
Assign the license to your admin account
Wait 5 or 10 minutes, then you should be able to access this:

If you don’t see any URLs, click the Restore default links.

Now you have 3 options:

If you will never use Intune, select None for both MDM and MAM
Select All to enroll all users
If you want to use Intune but not all users are licensed, choose Some and create a dynamic group containing users licensed for Intune, e.g.:

user.assignedPlans -any (assignedPlan.servicePlanId -eq "8e9ff0ff-aa7a-4b20-83c1-2f636b600ac2" -and assignedPlan.capabilityStatus -eq "Enabled")

Once you’ve done this, try signing in to the computer again and it should work. Note that you may need to reboot a computer if you had already tried and failed to join before making the changes.

Troubleshooting Common MDM Join Errors

Error: “You need a license to enroll in MDM”

If you see this error after configuring MDM scope, the user account doesn’t have an Intune license assigned. Assign a license containing Microsoft Intune (or Microsoft Entra ID P1) from the Microsoft 365 admin centre.

Error: “Device enrollment disabled”

Check that device enrollment isn’t restricted in Intune → Device enrollment → Enrollment restrictions. If you’ve set platform restrictions, ensure Windows MDM enrollment is allowed.

Error: “Something went wrong — try again later”

This generic error often appears when Microsoft Entra ID can’t reach your MDM terms of use URL. Verify the URL is correct under Microsoft Entra ID → Mobility (MDM and MAM) → Microsoft Intune — the MDM terms of use URL should point to a valid HTTPS endpoint.

FAQ

Q: Do all users need an Intune license? No. Only users who need MDM enrollment require a license. Set the MDM user scope to Some and use a dynamic group (as shown above) to target only licensed users.

Q: Will changing MDM scope affect existing enrolled devices? No. Changing the scope only affects new device enrollments. Already-enrolled devices remain managed.

Q: Can I skip Intune enrollment entirely? Yes. Set both MDM and MAM user scopes to None to join devices to Microsoft Entra ID without Intune enrollment.