Forum Discussion
Intune Platform Scripts never target devices (0 targeted devices) despite healthy Intune environment
Hi everyone,
I'm hoping someone has seen this before because I've exhausted most of the obvious troubleshooting.
Environment
- Microsoft 365 Business Premium
- Windows 11 Pro
- Microsoft Intune
- Microsoft Entra ID Joined devices
- Intune Management Extension (IME) installed and healthy
The Issue
Platform Scripts never target any devices.
Regardless of the script, assignment or device, the script always remains at:
- 0 Devices
- 0 Succeeded
- 0 Errors
The device never appears under Device Status.
What works
The Intune environment is otherwise functioning normally.
- Configuration Profiles deploy successfully.
- Settings Catalog policies apply successfully.
- BitLocker policies apply.
- Windows Firewall policies apply.
- Windows LAPS is working.
- Win32 applications deploy successfully
- Devices are Entra Joined and managed by Intune.
What I've tested
To eliminate variables I created:
- Created a brand new PowerShell script that simply creates a text file.
- Created a brand new assigned Security Group containing a single Windows 11 device.
- Assigned only that Security Group to the Platform Script.
The result is still:
- 0 Devices
- 0 Succeeded
- 0 Errors
Device checks completed
On the client:
- dsregcmd /status shows AzureAdJoined = YES.
- Intune Management Extension service is running.
- Win32 apps are deploying correctly.
- Intune Management Extension logs appear healthy.
- AgentExecutor.log contains WinGet application activity but no evidence of any Platform Script ever being downloaded or executed.
- The IntuneManagementExtension registry contains SideCarPolicies but there is no evidence of any PowerShell script policy being received.
Additional observations
- I reproduced the issue on two separate Windows 11 devices.
- I reproduced the issue using both dynamic and assigned device groups.
- I reproduced the issue using different PowerShell scripts.
This makes me believe the issue is not device specific.
Question
Has anyone seen Platform Scripts remain permanently at 0 targeted devices despite Intune otherwise functioning normally?
Is there a known tenant-side issue, prerequisite or licensing requirement that would prevent Platform Scripts from ever targeting devices while Win32 apps and Configuration Profiles continue to work?
Any suggestions would be appreciated.
Final Update / Resolution
I wanted to provide a final update in case it helps someone else.
After working with Microsoft Support, the issue was ultimately traced to the device itself rather than Intune or the Platform Script configuration.
The original symptoms were:
- Platform Scripts assigned to device groups remained at 0 targeted devices or the affected device never appeared in Device Status.
- The same Platform Scripts executed successfully when assigned to user groups.
- Win32 applications, configuration profiles and other Intune workloads continued to work normally.
During troubleshooting we confirmed:
- Device and user group assignments were correct.
- No assignment filters or exclusion groups were configured.
- Intune Management Extension was healthy.
- Simple test scripts produced the same behaviour.
- Platform Scripts assigned to All Devices executed successfully across the rest of the tenant.
- The problem was isolated to a single device.
Microsoft reviewed the client logs and confirmed the Platform Script policy was never reaching the affected device.
The resolution was to perform a full Intune wipe of the device and allow it to complete a fresh Windows Autopilot enrollment.
Following the rebuild:
- Device-targeted Platform Scripts executed successfully.
- The device appeared correctly in Device Status.
- Existing Platform Scripts (including our TLS hardening script) executed without issue.
The exact root cause of the original enrollment is still unknown, and I have asked Microsoft whether they can identify what prevented Platform Script assignments from reaching the original enrollment.
Thanks to everyone who offered suggestions throughout the investigation.
5 Replies
Final Update / Resolution
I wanted to provide a final update in case it helps someone else.
After working with Microsoft Support, the issue was ultimately traced to the device itself rather than Intune or the Platform Script configuration.
The original symptoms were:
- Platform Scripts assigned to device groups remained at 0 targeted devices or the affected device never appeared in Device Status.
- The same Platform Scripts executed successfully when assigned to user groups.
- Win32 applications, configuration profiles and other Intune workloads continued to work normally.
During troubleshooting we confirmed:
- Device and user group assignments were correct.
- No assignment filters or exclusion groups were configured.
- Intune Management Extension was healthy.
- Simple test scripts produced the same behaviour.
- Platform Scripts assigned to All Devices executed successfully across the rest of the tenant.
- The problem was isolated to a single device.
Microsoft reviewed the client logs and confirmed the Platform Script policy was never reaching the affected device.
The resolution was to perform a full Intune wipe of the device and allow it to complete a fresh Windows Autopilot enrollment.
Following the rebuild:
- Device-targeted Platform Scripts executed successfully.
- The device appeared correctly in Device Status.
- Existing Platform Scripts (including our TLS hardening script) executed without issue.
The exact root cause of the original enrollment is still unknown, and I have asked Microsoft whether they can identify what prevented Platform Script assignments from reaching the original enrollment.
Thanks to everyone who offered suggestions throughout the investigation.
Hi, when Intune scripts show 0 targeted devices even though the environment looks healthy, I usually check assignment and device eligibility first.
A few places to look:
1. Confirm the assignment group contains devices, not only users, or test with a simple device group.
2. Make sure the devices are Intune-managed and checking in successfully.
3. Check whether filters are excluding the devices.
4. Confirm the script platform matches the device platform and architecture.
5. Test with one very simple script assigned to one known-good device.
If a simple one-line script still shows 0 targeted devices, I would gather the assignment details, device ID, and IntuneManagementExtension logs from that test device before opening a support case.
Thanks for the suggestions.
I don't believe it's related to script formatting or execution policy, as the exact same script executes successfully when assigned to a user group.
Microsoft has also reviewed the collected logs and advised they do not see any script download or execution attempts reaching the affected device, suggesting the assignment isn't reaching the client rather than the script failing to execute.
They're currently monitoring a fresh test assignment from the service side to determine where the assignment process is stopping.
Thanks again.
Are there any system time mismatches on your devices?
Have you checked script formatting (ASCII, etc.)? I assume you have already verified the prerequisites.
What does the script execution policy look like on your devices?
Good luck!
Update: During troubleshooting I found that newly created Win32 apps are receiving assignments correctly. Device-centric logs show the app assignment reaches the client and the Intune Management Extension processes it. The issue now appears to be isolated to Platform Scripts, which continue to show 0 targeted devices despite healthy Entra-joined devices, successful MDM enrolment, and a functioning IME. Existing Configuration Profiles, BitLocker, LAPS, Firewall policies, and Win32 app deployments are all working.
