Things to check in terms of proper portal configuration:

1. You have a Symantec certificate of the correct type – no, you can’t just create your own cert. If you don’t have one, use the trial certificate tool.
2. The certificate has not expired.
3. You have downloaded the correct Windows Phone SSP – use the one on the download center.
4. You have successfully signed the WP SSP xap file with the Symantec cert.
5. ConfigMgr:

• You have created an application package that contains the xap and you have deployed it
• You have uploaded either the certificate pfx or the aet on the Windows Phone tab of the Intune subscription wizard

• Intune standalone

• You have uploaded the signed xap and the certificate pfx
• You have deployed the package created by Intune

If you think you did all of that correctly, then here are a few other things to try:

• Make sure the phone you are enrolling is not in low battery mode – that can block the installation
• If you have a Windows Phone 8.1, you can go to Settings, Workplace and touch the organization name. Assuming you did all the configuration correctly, and assuming nothing has been horked on the phone, you should see a button that says “download hub”. Unfortunately that doesn’t exist on Windows Phone 8.

• Attach the signed SSP to an email and mail it to the phone user. The user can open the email then touch the attachment to try and install the xap.

• If the phone is correctly enrolled, the portal should just open. If there’s a problem with the application enrollment token (AET) you’ll see a message about “you need to enroll the phone”. Try un-enrolling and re-enrolling. If that doesn’t help, try doing step 5 or 6 above to make sure your AET is uploaded correctly.
  
    
  
• If the portal isn’t signed correctly, you get a message about “there’s a problem with this company app” – go back and sign the app again.
  
  
  
• If the phone cannot contact the enterprise phone home service to check the validity of the enrolled enterprises, it will retry every 20-24 hours. It tries via cellular internet or Wi-Fi. If it fails, it tallies a failure count and when it has tried and failed seven times, you see this message:
  
  
  

If you get this message:

• No more enterprise apps can be installed.
• Enterprise apps already installed will continue to launch properly.
• AETX enrollments are still allowed

Ways for them to fix this would be:

• Unenroll/reenroll. 
• Enroll in a different enterprise.
• Wait for 24 hours with a constant network connection available.

Please consider leaving a reply in case this post helped you.