Enrollment outcomes

enroll() resolves for every outcome — a failure is data, not an exception, and the promise only rejects for programming errors. Eleven outcomes are possible and exactly one resolves. They are grouped below by what your app should do, which is not the same as how bad the outcome sounds.

Let the user in — 3 of 11Not an error. The app runs.

• succeeded

  Identity registered, policy in force.

  Continue into the app.

• notTargeted

  Licensed, but no administrator has aimed a policy at this account.

  Continue. The app runs unmanaged — nothing is meant to be enforced yet.

• notLicensed

  The tenant uses Intune; this employee has no licence.

  Continue. The SDK keeps retrying in case a licence appears later.

  Do not block the user. Treating this as a failure locks out an employee who is allowed in.

Handle it — 6 of 11Something to do about it.

• failed

  Licensed and targeted, but enrollment failed — including the service being unreachable.

  Block access to corporate data until it succeeds.

• pending

  First attempt in progress.

  A progress state is reasonable here.

• authorizationNeeded

  No valid token was supplied.

  Check your token provider, then retry.

• wrongUser

  A different account is already enrolled.

  Block this account's data; the SDK prompts the user to remove one.

• companyPortalRequired

  Android only — the broker is missing.

  The SDK drives the install prompt; supplement it with your own copy.

• unknown

  A status this version does not map.

  Treat it conservatively and open an issue.

Reset states — 2 of 11Not reached by enroll().

• unenrolled

  Terminal state of a completed reset.

  Handled by the reset flow, not by this branch.

• unenrollmentFailed

  Terminal state of a reset that did not finish.

  The journal reopens it on the next launch.

warning

The most common integration bug in libraries like this one is treating anything that isn't succeeded as "block the user". That breaks every customer who has staff without Intune licences, and every pilot where the policy has not been targeted yet. notLicensed and notTargeted mean the opposite of failed — that distinction is prescribed by Microsoft, not invented here.

note

enrollment.nativeCode carries the raw SDK constant name (LicensedNotTargeted, AccountNotLicensed, EnrollmentEndPointNetworkFailure, …). Put it in your support logs: it is the difference between "unlicensed" and "licensed but untargeted", which look identical from the unified status alone.

---