my new iPhone Duo running IOS 27.2 is unable to pass Device compliance step in Comp Portal

Test the compliance check on an approved alternate network because the failed 13.107.*, 150.171.97.*, and 2620:1ec:* addresses are documented Intune Azure Front Door endpoints, and the log shows connectivity failures during the check-in operation.^1^

1. Isolate the network path

1. Disconnect from the current Wi-Fi and connect through cellular data or an approved personal hotspot.
2. Open Company Portal → Devices → select this iPhone → Check status.^2^
3. Note the result:
   • It succeeds: the original Wi-Fi, VPN, proxy, DNS filter, firewall, or HTTPS-inspection path is interfering with Intune communication.
   • It still fails: continue with the authentication and tenant checks below.
   • Company Portal displays “Unable to sync”: tap Set up beside that notification and complete the Company Access Setup prompts.^3^

Do not disable an organization-managed VPN, DNS filter, or security application without IT approval. Prefer an approved alternate network; if IT authorizes disabling a control for testing, avoid sensitive activity and re-enable it immediately afterward.

The log does not prove that IPv6 is entirely unavailable: some IPv6 destinations returned 200, while other IPv4 and IPv6 requests failed. Network staff should therefore review routing, filtering, proxying, and HTTPS inspection rather than disabling IPv6 based on this log alone.

If the alternate-network test succeeds, provide the network team with the log and ask them to:

• Permit the consolidated Intune FQDNs and Azure Front Door ranges over TCP 80/443.
• Check the listed [IP Address]/24, [IP Address]/24, [IP Address]/23, [IP Address]/24, and 2620:1ec:40::/48, 2620:1ec:49::/48, and 2620:1ec:4a::/47 ranges.
• Ensure SSL inspection is not applied to *.manage.microsoft.com or *.dm.microsoft.com; Microsoft states that SSL inspection is unsupported for those Intune endpoints.^1^

2. Have the administrator distinguish authentication from compliance failure

A single 401 entry does not identify the root cause, particularly when other requests returned 200.

Ask the Entra administrator to open:

Microsoft Entra admin center → Entra ID → Monitoring & health → Sign-in logs

Filter by:

• Your account
• The failure timestamp, October 26, 2026 at 16:49 PDT
• Status: Failure

Open the matching record and capture the application, failure reason, sign-in error code, correlation ID, and Conditional Access result. Access to these details requires at least the Reports Reader role.^4^

The Intune administrator should also examine the new device record and verify:

• Last check-in is current.
• Intune compliant and Microsoft Entra compliant status.
• The specific compliance-policy setting reporting noncompliance.
• Whether the device appears twice or the check-in is attached to a stale record.

A device that cannot check in cannot receive its assigned policies, so an old check-in time points back to enrollment or service connectivity rather than a failed device setting.^5^

3. Check for an iOS 27 service or compatibility issue

There has been public discussion of DDM check-in failures after iOS 27.0, but no public Microsoft confirmation in the supplied information specifically covering iOS 27.2 + Company Portal + NWError 50 + HTTP 401.^6^

Your administrator should check both:

• The tenant’s Microsoft 365 Service health for an Intune advisory.
• Microsoft’s public Intune known-issues page.^7^

If other iOS 27.x devices fail similarly while earlier versions work on the same network and tenant, include that comparison in the support case.

4. Submit fresh diagnostics

Since reinstalling Company Portal and the management profile has already been tried, do not repeat that process without a specific admin finding.

Immediately after reproducing the failure:

1. In Company Portal, tap More → Send Logs. Alternatively, tap Report on the error.
2. Upload the Company Portal logs.
3. If prompted, tap Open Authenticator to collect its logs.
4. Save the resulting incident ID.
5. Give IT the incident ID, timestamp, network used, and whether the alternate-network test changed the result.^8^

If the network and sign-in checks do not expose the failure, the Intune administrator should open a Microsoft support case with that incident ID and the affected device’s Intune and Entra records.

References

1. Network endpoints for Microsoft Intune
2. Check compliance on your iOS device
3. iOS or iPadOS devices won't check in with Microsoft Intune - Intune
4. How to troubleshoot Microsoft Entra sign-in errors
5. Troubleshooting policies and profiles in Microsoft Intune
6. DDM Check in errors after ios 27.0 update | Microsoft Community Hub
7. Known issues with Microsoft Intune - Intune | Microsoft Learn
8. Report problems in Company Portal app for iOS - Microsoft Intune