UserLicenseTypeInvalid when enrolling an iOS device in Intune/ConfigMgr

When setting up and connecting Windows Intune to System Center Configuration Manager 2012 R2 and you are trying to enroll a mobile device (iOS device), you may receive the error “UserLicenseTypeInvalid”.

Checking the cloudusersync.log on the ConfigMgr server listed the following two lines which seemed to be relevant:

ERROR: SetLicensedUsers exception System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'msub05.manage.microsoft.com'

Solution: Simply restart the SMS_EXECUTIVE service and everything is back on track and you can enroll the user on the mobile device. I have seen this a few times now and thought I’d share some information on it, not sure why it fails quite often though.

UPDATE: I have also seen this (without the error message above) when the user has not been added yet to the User Collection and synced to Intune. Solution is to make sure that the user is added to the Intune user Collection and make sure via cloudusersync.log that the user is added correctly to the Intune service.