Skip to content

Microsoft Entra hybrid join · Authentication (federated) phase

Fix hybrid join error 0xCAA20003 (SAML token rejected)

0xCAA20003 · ERROR_ADAL_SERVER_ERROR_INVALID_GRANT Checked against Microsoft Learn

Quick answer

0xCAA20003 is a federated-domain authentication failure during Microsoft Entra hybrid join. Your on-premises identity provider issued a SAML token, and Microsoft Entra ID rejected it (invalid_grant). Microsoft's guidance is to check the federation server settings and find the server error code in the authentication logs (User Device Registration event 305).

Check this first

Find User Device Registration event ID 305. Its server error code and message tell you why Microsoft Entra ID rejected the token.

What 0xCAA20003 means

Microsoft Entra ID didn't accept the SAML token from the on-premises identity provider.

Common causes

  • The SAML token from the on-premises identity provider wasn't accepted by Microsoft Entra ID.
  • Federation server configuration (claims or token settings) that doesn't match what Microsoft Entra ID expects for device registration.

How to fix 0xCAA20003

  1. Confirm the domain is federated; this phase applies only to federated accounts.
  2. Open Event Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration and read event ID 305 for the server error code and message.
  3. Review the federation server settings for device registration against Microsoft's hybrid join configuration guidance for federated domains.
  4. Fix the problem the server error names, then retry the join and check dsregcmd /status.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Microsoft Entra hybrid join codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.