Recently I was setting up Co-Management in SCCM Current Branch 1810. I was having issues with clients not being enrolled into Intune.

First I confirmed that the device was Hybrid Azure AD joined (this is a requirement, the device needs to be registered in Azure AD) then when looking at the CoManagementHandler.log file on the client I saw the error:

MDM enrollment failed with error code 0xcaa9001f ‘Integrated Windows authentication supported only in federation flow.’. Will retry in 240 minutes…

I found this error to be misleading. I am using Azure AD Connect with password sync, and not ADFS.

In my case, this error was caused by an enrollment restriction being set that blocked Windows 10 devices from being enrolled.

In Intune (portal.azure.com or devicemanagement.microsoft.com) in Device enrollment > Enrollment restrictions

In my Default restriction in Properties, then Select platforms, I had Windows (MDM) set to Block.

After allowing Windows (MDM) to Allow, the CoManagementHandler.log said Queuing enrollment timer to fire at 01/15/2019 21:42:19 local time

After trying again it was successfully enrolled into Intune and you can see the Managed By now says MDM/ConfigMgr Agent