How to fix Azure AD 801c03ed error in Windows?

Error 801c03ed appears when Windows tries to join a PC to Microsoft Entra ID, the new name of Azure AD, and the server answers Administrator policy does not allow user to device join. Nothing is broken on the PC. An administrator has to allow your account to join devices or enable the PC's device record, so start with Fix 1 or send IT the details.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2 setup (OOBE) and Settings, read against Microsoft's Windows Autopilot troubleshooting FAQ and Intune Windows enrollment error documentation.

What error 801c03ed means and where it appears

You turn on a new or reset PC, choose to set it up for work or school, and sign in with your work address. Instead of the next setup screen, Windows shows Something went wrong and the code 801c03ed. The full text reads: Confirm you are using the correct sign-in info and that your organization uses this feature. You can try to do this again or contact your system administrator with the error code 801c03ed.

The password was accepted. The error comes one step later, when Windows asks Microsoft Entra ID (called Azure Active Directory or Azure AD until 2023) to create a device record for the PC. The server's reply, shown as Server error code: 801c03ed in the details, is the line people search for: Administrator policy does not allow user followed by your address and to device join.

What causes error 801c03ed, ranked

The order below follows Microsoft's Autopilot documentation and the technical write-up we read. It is our ranking by how often each cause is described, not a measured statistic.

How to fix error 801c03ed in Windows

Fix 1 to Fix 4 are done by an administrator of the organisation's Microsoft Entra ID and Intune. If you are not one, send IT the error code, your sign-in address and the time of the attempt, or use Fix 5 on a PC you own. After every fix, select Try again on the PC: success is the next setup screen or Connected to your organisation in Settings.

Fix 1. Allow the user to join devices to Microsoft Entra ID

5 minutesLow riskAdministrators, first. The error says Administrator policy does not allow user ... to device join, or several new PCs fail for the same people.

801c03ed is the answer Entra ID gives when the join setting excludes the signed-in user. In user-driven and pre-provisioned Autopilot, the user's own account creates the join, so it must be allowed.

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com as an administrator who can change device settings.
2. Go to Identity > Devices > Device settings. In the Azure portal the same page is Microsoft Entra ID > Devices > Device Settings.
3. Find Users may join devices to Microsoft Entra. If it is None, select All, or select Selected.
4. With Selected, open the list and use Add Members to add the user or a group that holds everyone who sets up PCs.
5. While you are on the page, check Maximum number of devices per user. Microsoft's default is 50; raise it if this user already has that many.
6. Select Save.
7. On the PC, select Try again, or restart it and sign in again. The join needs a working connection: How to check your internet connection in Windows.

Selected is the safer choice for most organisations: it keeps personal devices out while the people who set up PCs can join them. The setting on the line below, Users may register their devices with Microsoft Entra, is a different thing: it controls registration, the lighter link that Fix 5 uses.

Fix 2. Enable the PC's disabled device object in Entra ID

5 minutesLow riskThe PC is registered in Windows Autopilot and other PCs join fine, but this one fails with 801c03ed.

Autopilot creates a Microsoft Entra device object when the hardware hash is imported. If someone disabled that object, the join for that serial number is refused although the user is allowed to join.

1. Sign in to the Microsoft Intune admin center at https://intune.microsoft.com.
2. Go to Devices > Enroll devices > Devices, the list of Windows Autopilot devices.
3. Search for the PC by its serial number and select it.
4. Open the linked Microsoft Entra device from its details.
5. Select Enable at the top of the device page and confirm.
6. On the PC, select Try again or restart the setup.

You can do the same in the Entra admin center: open Devices > All devices, search for the PC's name or serial, select it and select Enable. If the device is missing from that list, it was deleted rather than disabled: use Fix 3.

Fix 3. Delete and import the Autopilot device again when its Entra object was deleted

20 to 30 minutesRead the warningThe PC is in the Windows Autopilot list, but its Microsoft Entra device object was deleted, for example during a clean-up of old devices.

Microsoft calls this object Autopilot's anchor in Entra ID. Deleting it can cause join errors, and Microsoft's fix is to delete and import the device again, which creates the object anew.

1. In the Intune admin center, open Devices > Enroll devices > Devices.
2. Select the PC by its serial number, select Delete and confirm with Yes.
3. Wait a few minutes and select Refresh until the PC is gone from the list.
4. Collect the hardware hash again the way your organisation did the first time: from the maker or reseller, or with the Get-WindowsAutopilotInfo script.
5. Select Import, choose the CSV file and wait for the import to finish.
6. Set the group tag and user again, and wait until Profile status shows Assigned.
7. Reset or restart the PC and run the setup again.

Fix 4. Allow the provisioning package account to join devices

10 minutesLow riskYou enroll PCs in bulk with a provisioning package from Windows Configuration Designer or the Set up School PCs app, and the setup fails.

Microsoft explains that these tools create Entra accounts named Package_GUID that join the PCs. If those accounts are not allowed to join devices, the bulk enrollment fails for the same policy reason.

1. Sign in to the Azure portal at https://portal.azure.com as an administrator.
2. Go to Microsoft Entra ID > Devices > Device Settings.
3. Set Users may join devices to Microsoft Entra ID to All or Selected.
4. With Selected, select Add Members and add every Package_GUID account of your provisioning packages.
5. Select Save and apply the package to the PC again.

Microsoft's enrollment documentation shows this cause under the message A setup failure has occurred during bulk enrollment. The account name begins with package_ followed by a long ID, so search for that prefix in the member list.

Fix 5. Your own PC: set it up for personal use and connect the work account

15 minutesLow riskThe PC is yours, not the organisation's, and you only need work mail, Teams and Office. Your IT does not allow users to join devices.

Many organisations block joins but allow registration. A registered PC keeps your own account and signs in to work apps, while the blocked join would hand control of the PC to the organisation.

1. At the 801c03ed screen, go back to the setup choice and select Set up for personal use on Windows 11 Pro, or finish the setup with a personal Microsoft account.
2. If you want no online account at all, create a local one: Create a new user account to test a problem.
3. After the desktop opens, go to Settings > Accounts > Access work or school.
4. Select Connect, type your work or school address and sign in. Do not select Join this device to Microsoft Entra ID, which would hit the same block.
5. Open Outlook, Teams or the Office apps and sign in with the same address.

If your organisation also blocks registration or requires managed devices, the work apps will say so after sign-in. In that case only IT can decide, and the answer may be a company PC.

If 801c03ed is still there: logs to read and what to send IT

When the join setting and the device object are fine and the error stays, the PC's own logs show the step that failed. Microsoft points to the Autopilot event log for this; the device registration log adds the server's answer.

• Autopilot log: in Event Viewer, open Applications and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider > Autopilot. Look for errors at the time of the attempt.
• Device registration log: Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin holds the join result.
• During setup: press Shift + F10 to open a command prompt, type eventvwr and press Enter to open Event Viewer before the desktop exists.
• For IT: the code 801c03ed, the server message, your sign-in address, the PC's serial number and the time of the attempt.

How to keep 801c03ed from coming back

The error returns when a security change or a device clean-up hits accounts and PCs that still need to join. A few habits on the administrator side keep the setting and the device records in step with the people who set up PCs.

• Use a group with Selected, such as one for IT staff and new hires, instead of single users who are easy to forget.
• Never delete Autopilot device objects in Entra ID during clean-ups. Microsoft warns that this leads to join errors. Delete the Autopilot record instead when a PC leaves.
• Disable, then wait, when you retire a device. A disabled object can be enabled again in seconds; a deleted one needs a new import.
• Add new provisioning package accounts to the Selected group each time you build a package.
• Tell staff with personal PCs to use Access work or school > Connect, not a join during setup.

Frequently asked questions

What does error code 801c03ed mean?

It means Microsoft Entra ID, formerly Azure AD, refused to join the PC because of an administrator policy. The server message reads Administrator policy does not allow user, then your address, then to device join. Your password was accepted. Either your account is not allowed to join devices, or the PC's device object in Entra ID is disabled or deleted. Both are settings in the organisation's tenant, so the fix is made by an administrator, not on the PC.

Can I fix 801c03ed myself without an administrator?

Not on a PC that must join the organisation. The block is a tenant setting in Entra ID, and nothing on the PC changes it: reinstalling Windows, updating drivers or running repairs gives the same answer. What you can do is send IT the code, your address, the serial number and the time. On a PC that you own, you can skip the join, set it up for personal use and connect your work account under Access work or school (Fix 5).

Why do I get 801c03ed during OOBE on a new laptop?

OOBE is the first setup of Windows. When you choose a work or school setup, or the laptop is registered in your organisation's Windows Autopilot, Windows joins it to Entra ID right after you sign in. If the tenant does not let your account join devices, or the laptop's Autopilot device object is disabled, OOBE stops with 801c03ed. The administrator fixes it with Fix 1 or Fix 2, and you then select Try again without resetting the laptop.

Is "Server error code 801c03ed" on Windows 11 different from Windows 10?

No. The code comes from the Entra ID service, not from Windows, so Windows 11 25H2, 26H2 and Windows 10 22H2 show the same code and message for the same cause. The fixes are identical. Windows 10 left support on 14 October 2025, so a company that still sets up Windows 10 PCs without Extended Security Updates should plan to move them, but that is not what causes this error.

What are errors 0x801c03f3 and 0x801c03f2?

They belong to the same family of Entra ID device registration codes, but they are not 801c03ed. We could not confirm their exact meaning in the Microsoft documentation we read. Administrators report them mostly around a device object that Entra ID cannot find, which is the situation Fix 3 repairs. Before you act on either code, read the device registration and Autopilot logs described above, because the server message in the log names the real reason.

Should I set Users may join devices to All?

Only if every user in the organisation may own a joined PC. All is the quickest test and fixes the error at once, but it also lets anyone join a personal device. Most organisations use Selected with a group for the people who set up PCs. Microsoft supports both. If you choose Selected, remember to add new staff and provisioning package accounts to the group, or the error returns for them.

How long after the change can the user try again?

Microsoft does not state a time. In practice, select Save, then let the user select Try again on the error screen. If the old answer comes back, restart the PC and sign in again, which repeats the whole join. Changes to group membership can take longer than a direct change of the setting, so adding the user directly is the fastest way to test.

Does a disabled device object cause 801c03ed?

Yes, according to the technical write-up we read, and Microsoft's Autopilot FAQ confirms that problems with this object lead to Entra join errors. Autopilot creates the object when the hardware hash is imported. If it is disabled, the join of that PC fails even for allowed users. Enable it in Intune or in the Entra admin center (Fix 2). If it was deleted, Microsoft's fix is to delete and import the Autopilot device again (Fix 3).

I bought a used laptop and setup asks for a company sign-in. What now?

The laptop is probably still registered in the previous owner's Windows Autopilot, so setup expects that organisation's accounts. Your own work account will not pass there, and you cannot remove the registration yourself. Contact the seller and ask them to have the previous owner delete the device from their Autopilot list. Until then, the laptop keeps showing that organisation's sign-in after every reset.