No certificate detected

Complete the Company Portal enrollment and device-registration flow on the iPhone; if “No certificate detected” prevents completion, send Company Portal diagnostics to your organization’s IT help desk because the required certificate or authentication policy is controlled by its Intune/Entra configuration.

On the iPhone

1. Connect to stable Wi-Fi and install or update both:
   • Intune Company Portal
   • Microsoft Authenticator
2. Open Company Portal, sign in with the work or school account, and select Get started.
3. When Safari asks to download the management profile, select Allow, then Close.
4. Open Settings:
   • Select Profile Downloaded, or
   • Go to General → VPN & Device Management.
5. Select Management Profile → Install, enter the device passcode if requested, and select Install and Trust when prompted.
6. Return to Company Portal → Notifications and select the pending option to register the device. Keep Company Portal open until policies finish downloading. Pausing enrollment for several minutes can end the setup and require restarting it. ^1^

If Company Portal displays Unable to sync, select Set up beside that message and complete the Company Access Setup prompts. A successful repair displays Sync successful. ^2^

Do not manually install an unknown certificate or remove an existing management profile unless your IT team instructs you to do so; removing the profile can unenroll the device and remove managed corporate data.

If the certificate message remains

In Company Portal:

1. Reproduce the error.
2. On the error, select Report. Alternatively, open More → Send Logs.
3. Wait for the upload and, if requested, select Open Authenticator to collect its logs too.
4. Save the incident ID and give it, the error time, and a screenshot to your organization’s help desk. ^3^

Because this is an organization-managed account, the organization’s administrator—not personal Microsoft account support—must correct missing Intune certificates, device registration, Conditional Access, or MFA registration.

Checks for the Intune/Entra administrator

The administrator should first determine whether the failed step is device enrollment, certificate-based authentication (CBA), or MFA:

1. In the Microsoft Entra admin center, go to Entra ID → Monitoring & health → Sign-in logs.
2. Filter by the user and failure time.
3. Open the failed event and inspect:
   • Authentication Details for the method requested.
   • Conditional Access for the policy that interrupted access.
   • Troubleshooting and support for compliance or registration details.
     At least the Reports Reader role is required to perform the documented Conditional Access investigation. ^4^
4. Run the Intune iOS/iPadOS enrollment diagnostic from Microsoft 365 admin center → Show all → Support → Help & support, enter the affected user, and select Run tests. This requires an administrator and is unavailable in certain sovereign environments. ^5^
5. If Intune is supposed to issue an SCEP certificate, use Intune admin center → Troubleshooting + Support → Troubleshoot, select the user, set Assignments to Configuration profiles, and verify:
   • The SCEP profile is assigned to the user.
   • The user belongs to the targeted group.
   • The iPhone has recently checked in. ^6^

Only if the sign-in log confirms certificate-based authentication

A documented iOS CBA failure can occur when Intune deploys the root certificate and SCEP profile but omits the issuing intermediate CA certificate. The administrator should create an iOS Trusted Root Certificate configuration policy containing the intermediate CA’s .CER file, assign it to the affected devices/users, and then have the user open Company Portal and refresh policy. ^7^

Do not apply that change merely from the wording “No certificate detected”; first confirm in the sign-in and Intune assignment data that the organization actually requires CBA and that the certificate chain or profile is missing.

If the logs show MFA rather than CBA and another method is already registered, select Sign in another way and use it. If no usable method exists, the organization’s administrator must reset or update the account’s authentication methods. Repeated attempts can temporarily block further verification, so stop retrying continuously while IT investigates. ^8^

References

1. Set up personal iOS device for work or school
2. iOS or iPadOS devices aren't checking in with the Intune service
3. Report a problem in Company Portal for iOS
4. Troubleshoot sign-in problems with Conditional Access
5. Troubleshooting device enrollment in Intune
6. Troubleshooting the deployment of SCEP certificates profile to devices in Intune
7. Certificate-based authentication for iOS fails to prompt for user certificates
8. Common problems with two-step verification for a work or school account