I run into this issue on small client setups where an organisation uses Microsoft 365 Business Standard or Basic without Intune device management licences.
You open Windows Settings, navigate to Accounts > Access work or school, click Connect, and enter the user’s work email address. Instead of connecting the account, Windows throws this error:
Something went wrong. Here are some possible reasons:
• Your device is already connected to your organisation.
• We couldn't auto-discover a management endpoint matching the username entered. Please check your username and try again. If you know the URL to your management endpoint, please enter it.Above the error message, Windows renders an empty MDM Server URL input field.
The licensing catch-22
This failure occurs because the Windows Settings wizard tries to do two things at once: register the device in Entra ID, and enrol the device into Mobile Device Management.
There are two potential root causes for this error and both are probably true. First, custom domain DNS records rarely include the CNAME entries for EnterpriseEnrollment and EnterpriseRegistration. Second, Microsoft tenants often have MDM auto-enrolment switched on by default, whether or not anyone in the tenant holds a licence that includes Intune.
Log in to intune.microsoft.com, go to Devices > Enrolment > Automatic enrolment, and without a licence plan that includes Intune device management you’ll see: “Automatic MDM enrollment is available only for Microsoft Entra ID Premium subscribers.” If automatic enrolment is on, you can’t turn it off.
Where the enrolment attempt actually comes from
In the Entra ID portal, under Mobility (MDM and MAM), you’ll usually find two related items: Microsoft Intune, and Microsoft Intune Enrollment, that exists specifically to handle the enrolment discovery step in the “Add work or school account” flow on Windows comptuers. The main Microsoft Intune app has no delete option in the portal (it is greyed out), but the Intune Enrollment entry behave can be removed.
Deleting the Intune Enrollment app
If nobody in the tenant uses Intune, deleting Microsoft Intune Enrollment from Mobility (MDM and MAM) is a reasonable fix. With this gone, Windows has nowhere to redirect the enrolment step, so “Add work or school account” skips it instead of attempting and failing.
One caveat, however: If you ever need it back, it must be recreated as a service principal via Microsoft Graph (Connect-MgGraph and a POST to servicePrincipals using its fixed app ID); it cannot be re-added with a simple click. It’s a PowerShell job for an admin, so treat the deletion as intentional rather than a quick toggle.
The Edge profile workaround
Even without touching Entra ID settings, you can bypass Windows Settings entirely and register the device from Microsoft Edge instead. Edge talks to the Windows Web Account Manager broker directly and completes the join without calling the MDM enrolment discovery pipeline:
- Open Microsoft Edge.
- Click the profile icon in the top right corner and select Set up new profile > Work or School.
- Click Sign in to sync data and enter the Microsoft 365 work email and password.
- When Windows presents the dialog asking to Stay signed in to all your apps or Allow my organisation to manage my device, leave the box checked and select Yes.
Selecting yes on the Edge dialog completes a standard Entra ID Workplace Join. The device appears in your Entra ID tenant as an Entra-registered device, and Windows writes a Primary Refresh Token to the local machine’s identity broker.
Because that token lives in Windows WAM, every other Microsoft application on the machine picks it up immediately. Outlook, Teams, OneDrive, and Word sign in without prompting for credentials a second time. The machine gets full single sign-on across the Microsoft 365 desktop suite.
Between the two fixes: the Edge workaround is quicker for a single machine and touches nothing tenant-wide, while deleting Microsoft Intune Enrollment fixes the Windows Settings path properly for every user in the tenant going forward.