Skip to content

Microsoft Entra hybrid join · Authentication (federated) phase

Fix hybrid join error 0xCAA82EE2 (authentication timeout)

0xCAA82EE2 · ERROR_ADAL_INTERNET_TIMEOUT Checked against Microsoft Learn

Quick answer

0xCAA82EE2 is a network timeout in the authentication phase of Microsoft Entra hybrid join (federated domains). Microsoft's fix: make sure both https://login.microsoftonline.com and your on-premises identity provider are reachable in the device's system context.

Check this first

Can the computer account (system context) reach both login.microsoftonline.com and your federation service URL?

What 0xCAA82EE2 means

A general network timeout while the device was getting a token for device registration.

Common causes

  • https://login.microsoftonline.com isn't reachable in the system context.
  • The on-premises identity provider (federation service) isn't reachable in the system context.
  • A proxy in the path that the system context can't use.

How to fix 0xCAA82EE2

  1. Confirm the domain is federated and find User Device Registration event ID 305 with 0xcaa82ee2.
  2. Test access to https://login.microsoftonline.com from the system context.
  3. Test access to your on-premises federation service endpoint from the system context.
  4. Fix firewall or proxy rules for both, following Microsoft's network connectivity requirements for hybrid join.
  5. Retry the join and check dsregcmd /status.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Microsoft Entra hybrid join codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.