Background - In Oct. 2024, an issue surfaced where users were unable to authenticate to their Yealink MP54 and MP56 phones.  Error messages were along the lines of "This device isn't enrolled in device administrator" and/or "Couldn't connect to Workplace join. Try again..."

Issue - Apparently (for an unknown reason), our Microsoft Azure / Intune configuration starting detecting these phones as "Personal Android Devices" and/or imposing a device enrollment restriction with a failure notification of "Device cannot be enrolled as personal".  Screenshots below.  This report was derived from https://intune.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_Enrollment/EnrollmentFailuresList

The details about these messages and suggested resolutions (visible after clicking on any given record) were articulated as follows:

A list of affected and/or logged devices on our system can be derived from https://admin.teams.microsoft.com/devices/ipphones

Microsoft Intune/Azure are not easy or intuitive to navigate to pinpoint where this can be resolved, but ultimately the setting to override this "block" was found in the Intune Admin Center under Devices > Enrollment > Personally-owned devices with a work profile > Enrollment restrictions > All Users > Android Device Administrator.  Had to click on "Edit" next to "Platform Settings" as shown below.

When actually navigating to this setting, it wasn't as intuitive.  It was more like Devices > Device onboarding > Enrollment > Device platform restrictions > All Users > Properties > [Platform Settings] Edit

Some useful/relevant resources pertaining to this issue are as follows:

- https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

- https://learn.microsoft.com/en-us/mem/intune/enrollment/android-work-profile-enroll

- https://support.yealink.com/en/portal/knowledge/show?id=634e70889b74dd53ff44ff0c

- https://www.reddit.com/r/Intune/comments/1cnerdj/microsoft_teams_devices_enrollment_issues/