Device Management Could Not Be Enabled (0x80192EE7): How to Fix

Applies to: Windows 11 and Windows 10 when signing in to Teams, Outlook or other Microsoft 365 apps, or adding a work or school account. Often shown with error -2145833241 (0x80192EE7).

What the error means

When you sign in to a Microsoft 365 app with a work or school account, Windows offers to register the PC with your organization. If you leave Allow my organization to manage my device ticked, Windows also tries to enroll the PC in device management. The sign-in works, but the enrollment step is refused, so you see “Device management could not be enabled”.

The number that comes with it is the same error written two ways: -2145833241 is 0x80192EE7 in hexadecimal. It doesn’t point to a fault in Windows itself. The usual causes are on the organization’s side:

• Your account isn’t licensed or allowed to enroll devices.
• The organization blocks personally owned Windows PCs from enrolling.
• You’ve reached the limit of devices you can enroll.
• An old Windows Information Protection (WIP) setting still applies to your account.

A few other codes can appear on the same screen and point to a specific cause:

Code	What it means	Who fixes it
80192EE7 / -2145833241	Enrollment was refused after sign-in	You (Fix 1), or IT
80180014	The organization doesn’t allow Windows devices to enroll	IT admin
8018000a	The PC is already enrolled by another account	You (Fix 4)
0x8018002b	Automatic enrollment failed (account name or settings issue)	IT admin

Fix 1: Sign in to the app only

If this is your own PC and you just want Teams or Outlook to work, skip device management:

1. Open the app again and sign in with your work account.
2. When Stay signed in to all your apps appears, untick Allow my organization to manage my device.
3. Select No, sign in to this app only.

The app signs in normally and your PC stays yours. If the checkbox is greyed out, or the app later says your device must be managed or compliant, your organization requires enrollment and you’ll need IT’s help (see the admin section).

Fix 2: Remove the half-added work account

A failed attempt can leave the account half-connected, so the error comes back every time an Office app starts. Remove it and start clean:

1. Select Start > Settings > Accounts > Access work or school.
2. Select your work account to expand it, then select Disconnect and confirm.
3. Restart the PC.
4. Sign in to Teams or Outlook again and use Fix 1 when the prompt appears.

Careful: if the account entry says the PC is connected to your organization’s Microsoft Entra ID (Azure AD), the PC belongs to the organization. Don’t disconnect it yourself; ask IT. If Teams keeps showing the old account afterwards, follow how to remove an account from Teams.

Fix 3: Clear saved Office sign-ins

Office apps save your sign-in in Windows Credential Manager. A stale entry can bring back the failed state.

1. Close all Office apps and Teams.
2. Press Win + S, type Credential Manager and open it.
3. Select Windows Credentials.
4. Expand entries that start with MicrosoftOffice16_Data or mention your work email, and select Remove on each.
5. Restart the PC and sign in again.

You’ll have to sign in to Office apps again afterwards. If sign-in then fails with a locked account, wait for the lock to clear or see “The referenced account is currently locked out”.

Fix 4: Check for another account already managing the PC

Code 8018000a means someone else’s work account already enrolled this PC, for example a previous owner or a family member’s school account. Only one account can manage the PC at a time.

1. Open Settings > Accounts > Access work or school and look for a work or school account that isn’t yours.
2. If it’s still in use, sign in to Windows as that person, disconnect their account there, then sign back in as yourself.
3. Try the sign-in again.

If the PC came from a company or school, check with them before removing anything. It may still be one of their managed devices.

For IT admins: why enrollment fails

If users must enroll, check these settings in the Microsoft Intune admin center:

• MDM user scope: go to Devices > Device onboarding > Enrollment > Windows tab > Automatic Enrollment. Make sure MDM user scope is All, or Some with a group that includes the user.
• WIP user scope: on the same page, set WIP user scope to None unless you still use Windows Information Protection. A user in both scopes is a common cause of 0x80192EE7 on personal PCs.
• MDM URLs: if the discovery, terms of use or compliance URLs were changed, restore the defaults on the same page.
• Licences: the user needs an Intune licence, and automatic enrollment needs Microsoft Entra ID P1 or P2.
• Platform restrictions: under Devices > Device onboarding > Enrollment > Device platform restriction, check that Windows (MDM) enrollment is allowed, including personally owned devices if you want those.
• Device limit: check the enrollment device limit restriction (1 to 15 devices per user) and remove stale devices for users who hit it.

If you don’t want users offered device management from personal PCs at all, change these settings rather than asking users to work around the prompt.

Related guides

• How to remove an account from Teams
• “The referenced account is currently locked out”
• How to add a shared mailbox in Outlook

Official sources: for more detail, see Microsoft’s own documentation:

• Microsoft Learn: Troubleshooting Windows device enrollment errors in Intune
• Microsoft Learn: Enable MDM automatic enrollment for Windows
• Microsoft Learn: Device enrollment restrictions in Intune

Frequently asked questions

Should I allow my organization to manage my device?

On a company PC, yes, if IT asks you to. On a personal PC it’s usually not needed for email and Teams, and it lets your organization apply policies to the PC and, in some setups, remove its data. Choose No, sign in to this app only unless your organization requires it.

Is error 0x80192EE7 a problem with my PC?

Almost never. It means the organization’s enrollment service refused this PC or this account. Your Windows installation is fine.

Can I use Teams and Outlook without enrolling?

Usually yes. Only organizations that use Conditional Access to require managed or compliant devices will block sign-in, and then the app tells you so.

Why does the prompt keep coming back?

A half-added account or a saved Office sign-in is still on the PC. Remove it (Fix 2 and Fix 3), restart, and choose sign in to this app only.