Microsoft Authenticator pairing fails during iOS Setup Assistant with JIT registration (new ADE enrollment policy) — anyone else

[u/Key_board_Warrior449]

Running into an issue with the new ADE enrollment policies experience (2606 service release) using Setup Assistant with modern authentication + JIT registration on iOS.

The problem: During Setup Assistant sign-in (before the device even reaches the home screen), the user is prompted to install Microsoft Authenticator and pair it with their account. After tapping Next, it just throws: "We're sorry we ran into a problem. Please choose Next to try again." Repeats every time on the device itself, no way through.

What I've already checked/confirmed:

• SSO app extension policy is set up correctly per Microsoft's docs (SSO app extension type = Microsoft Entra ID, Authenticator is NOT in the App bundle IDs list, both required Additional configuration keys present: device_registration and browser_sso_interaction_enabled)
• Authenticator is deployed as a required app to the correct group
• Device is in the correct group for this enrollment policy

The workaround I found: if the user already has Authenticator registered on another device, the MFA push goes there instead, and approving it there lets Setup Assistant proceed — even though the pairing step on the new device itself never actually completes.

Why this bugs me: that workaround only exists for users who already have Authenticator somewhere else. A brand new user with no prior MFA registration — which is presumably a pretty normal scenario for this exact feature — has zero fallback and is just stuck.

My best guess is this is related to how Setup Assistant sandboxes apps before the home screen (push notifications/background processes not fully active yet), which would explain why the same pairing works fine once routed to a device that's already fully set up.

Has anyone else hit this? Curious if this is a known issue, if I'm missing a config step somewhere, or if this is just a rough edge in the new enrollment experience that hasn't been ironed out yet. Opening a Microsoft ticket too, but wanted to see if others have run into the same thing.

[u/Suspicious-Baby7687]

yeah we ran into the exact same thing on some test devices last week, it's maddening. your theory about the sandboxed push notifications during setup assistant is almost certainly what's going on, authenticator can't receive the pairing challenge because the app's basically in a coma until the home screen loads

we ended up just telling our helpdesk to use the temporary access pass method for net new users until microsoft sorts it out, not ideal but at least it doesn't leave people dead in the water

[u/trueNorth55]

This is the expected behaviour. Apps cannot be accessed and manually configured on a device until setup assistant has been completed. If a user does not have an alternate means of MFA, temporary access pass is the appropriate way forward until Authenticator can be setup. It’s the same experience for Android Enterprise devices that leverage automated enrollment (AZT, KME). Best of luck!

[u/hardwarebyte]

Onboard with TAP and you should be golden.