Forum Discussion
Intune Platform Scripts never target devices (0 targeted devices) despite healthy Intune environment
Hi everyone,
I'm hoping someone has seen this before because I've exhausted most of the obvious troubleshooting.
Environment
- Microsoft 365 Business Premium
- Windows 11 Pro
- Microsoft Intune
- Microsoft Entra ID Joined devices
- Intune Management Extension (IME) installed and healthy
The Issue
Platform Scripts never target any devices.
Regardless of the script, assignment or device, the script always remains at:
- 0 Devices
- 0 Succeeded
- 0 Errors
The device never appears under Device Status.
What works
The Intune environment is otherwise functioning normally.
- Configuration Profiles deploy successfully.
- Settings Catalog policies apply successfully.
- BitLocker policies apply.
- Windows Firewall policies apply.
- Windows LAPS is working.
- Win32 applications deploy successfully
- Devices are Entra Joined and managed by Intune.
What I've tested
To eliminate variables I created:
- Created a brand new PowerShell script that simply creates a text file.
- Created a brand new assigned Security Group containing a single Windows 11 device.
- Assigned only that Security Group to the Platform Script.
The result is still:
- 0 Devices
- 0 Succeeded
- 0 Errors
Device checks completed
On the client:
- dsregcmd /status shows AzureAdJoined = YES.
- Intune Management Extension service is running.
- Win32 apps are deploying correctly.
- Intune Management Extension logs appear healthy.
- AgentExecutor.log contains WinGet application activity but no evidence of any Platform Script ever being downloaded or executed.
- The IntuneManagementExtension registry contains SideCarPolicies but there is no evidence of any PowerShell script policy being received.
Additional observations
- I reproduced the issue on two separate Windows 11 devices.
- I reproduced the issue using both dynamic and assigned device groups.
- I reproduced the issue using different PowerShell scripts.
This makes me believe the issue is not device specific.
Question
Has anyone seen Platform Scripts remain permanently at 0 targeted devices despite Intune otherwise functioning normally?
Is there a known tenant-side issue, prerequisite or licensing requirement that would prevent Platform Scripts from ever targeting devices while Win32 apps and Configuration Profiles continue to work?
Any suggestions would be appreciated.
4 Replies
Hi, when Intune scripts show 0 targeted devices even though the environment looks healthy, I usually check assignment and device eligibility first.
A few places to look:
1. Confirm the assignment group contains devices, not only users, or test with a simple device group.
2. Make sure the devices are Intune-managed and checking in successfully.
3. Check whether filters are excluding the devices.
4. Confirm the script platform matches the device platform and architecture.
5. Test with one very simple script assigned to one known-good device.
If a simple one-line script still shows 0 targeted devices, I would gather the assignment details, device ID, and IntuneManagementExtension logs from that test device before opening a support case.
Thanks for the suggestions.
I don't believe it's related to script formatting or execution policy, as the exact same script executes successfully when assigned to a user group.
Microsoft has also reviewed the collected logs and advised they do not see any script download or execution attempts reaching the affected device, suggesting the assignment isn't reaching the client rather than the script failing to execute.
They're currently monitoring a fresh test assignment from the service side to determine where the assignment process is stopping.
Thanks again.
Are there any system time mismatches on your devices?
Have you checked script formatting (ASCII, etc.)? I assume you have already verified the prerequisites.
What does the script execution policy look like on your devices?
Good luck!
Update: During troubleshooting I found that newly created Win32 apps are receiving assignments correctly. Device-centric logs show the app assignment reaches the client and the Intune Management Extension processes it. The issue now appears to be isolated to Platform Scripts, which continue to show 0 targeted devices despite healthy Entra-joined devices, successful MDM enrolment, and a functioning IME. Existing Configuration Profiles, BitLocker, LAPS, Firewall policies, and Win32 app deployments are all working.
