What you’re seeing
- Outlook or Teams on iPhone or Android shows "Set up your device to get access" every time the user signs in.
- Company Portal lists the phone as enrolled and compliant, yet the apps still refuse access.
- Tapping through the prompt opens Company Portal, which returns to the app and starts the loop again.
- On Android, the message may mention needing a broker app or a work profile.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The device record in Entra ID is not linked to the Intune enrollment, so conditional access cannot see the compliant status.
- The authentication broker (Microsoft Authenticator on iOS, Company Portal on Android) is missing or signed in with a different account.
- Duplicate or stale device records confuse the compliance check after a phone was re-enrolled.
- A conditional access policy demands a compliant device when the business intended to use app protection policies instead.
- Compliance status has not finished syncing from Intune to Entra ID after enrollment.
Why it matters
Phones are how many owners, managers and field staff stay on top of email and messages, so a sign-in loop cuts them off from customers and coworkers while they are away from a desk. People lose time repeating enrollment, and some start forwarding mail to personal accounts to get around the block, which creates a data leak of its own. The frustration also tends to land on IT when the policy itself is the problem.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
The phone says it's compliant. Why is it still blocked?
Intune and Entra ID keep separate records of the device. If those records are not matched up, the sign-in check does not know the phone is compliant, even though Company Portal shows it is.
Will the user lose anything on their phone?
Normally not. Resolving the loop usually involves the device registration and account setup, not the personal content on the phone.