Skip to content

Microsoft Entra hybrid join · Authentication (federated) phase

Fix hybrid join error 0xCAA90014 (WS-Trust fault)

0xCAA90014 · ERROR_ADAL_WSTRUST_REQUEST_SECURITYTOKEN_FAILED Checked against Microsoft Learn

Quick answer

0xCAA90014 happens in the authentication phase of Microsoft Entra hybrid join, and only for federated domains. The device asked your on-premises federation service (for example AD FS) for a token over WS-Trust, and the server answered with a fault. Microsoft's guidance: check the federation server settings and find the server error code in the authentication logs.

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Is the domain federated? This code applies only to federated domain accounts. Then open the User Device Registration log and find event ID 305 for the server error.

What 0xCAA90014 means

The federation server's WS-Trust response reported a fault exception, and the device failed to get an assertion.

Common causes

  • The on-premises federation service returned a WS-Trust fault instead of a token.
  • Federation server configuration problems. Windows gets the token with integrated Windows authentication to an active WS-Trust endpoint, so that endpoint has to be enabled and working.

How to fix 0xCAA90014

  1. Confirm the domain is federated. The authentication phase applies only to federated domain accounts.
  2. In Event Viewer, open Applications and Services Logs > Microsoft > Windows > User Device Registration and find event ID 305. Note the error code, sub-error code, server error code, and server message.
  3. Check the federation server settings, including that the WS-Trust endpoints used for integrated Windows authentication are enabled and published in the MEX response.
  4. Look up the server error code from event 305 in the federation server's own logs and fix the fault it names.
  5. Retry the join and check dsregcmd /status.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Microsoft Entra hybrid join codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.