Can onboard to MDE with stand-alone script, but gpo option does not work.

Please check the below:

• GPO Scope & Linkage
• Ensure the GPO is linked to the correct OU where the target machines reside.
• Confirm the security filtering includes the intended computers or groups.
• Script Execution Policy
• The onboarding script deployed via GPO must be allowed to run. Make sure the PowerShell execution policy isn’t blocking it (RemoteSigned or Unrestricted is usually safe).
• Startup Script Timing
• GPO onboarding uses a startup script, not a logon script. If the machine boots too quickly or the network isn’t ready, the script might silently fail.
• Network Connectivity
• The device must be able to reach the required MDE endpoints. You can test this using the MDE Client Analyzer tool.
• Script Placement
• The onboarding script should be placed in the SYSVOL share or a location accessible to all target machines.
• Registry Clues
• Check HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status for onboarding status.
• Also look at HKLM\SOFTWARE\Microsoft\SenseCM\EnrollmentStatus for any enrollment errors.

Reference: Troubleshooting MDE On-Boarding issues | Microsoft Community Hub