EPM deployed, no policies on device

So..... the epm agent is deployed to your device... so we can rule out issues with the dual/linked enrollment that the device should have gotten in the first place. The "policies" from the EPM agent are declared configurations documents... those rely on the declared configuration service (dcsvc.dll) so I would start looking at that service first and if you can spot the declarative docs in the registry \microsoft\declaredconfiguration

I have written some blogs about this stuff.. so feel free to reach out to me as I truly know how this stuff should work and also could break 🙂

https://call4cloud.nl/category/windc/