Intune Platform Scripts never target devices (0 targeted devices) despite healthy Intune environment

Final Update / Resolution

I wanted to provide a final update in case it helps someone else.

After working with Microsoft Support, the issue was ultimately traced to the device itself rather than Intune or the Platform Script configuration.

The original symptoms were:

• Platform Scripts assigned to device groups remained at 0 targeted devices or the affected device never appeared in Device Status.
• The same Platform Scripts executed successfully when assigned to user groups.
• Win32 applications, configuration profiles and other Intune workloads continued to work normally.

During troubleshooting we confirmed:

• Device and user group assignments were correct.
• No assignment filters or exclusion groups were configured.
• Intune Management Extension was healthy.
• Simple test scripts produced the same behaviour.
• Platform Scripts assigned to All Devices executed successfully across the rest of the tenant.
• The problem was isolated to a single device.

Microsoft reviewed the client logs and confirmed the Platform Script policy was never reaching the affected device.

The resolution was to perform a full Intune wipe of the device and allow it to complete a fresh Windows Autopilot enrollment.

Following the rebuild:

• Device-targeted Platform Scripts executed successfully.
• The device appeared correctly in Device Status.
• Existing Platform Scripts (including our TLS hardening script) executed without issue.

The exact root cause of the original enrollment is still unknown, and I have asked Microsoft whether they can identify what prevented Platform Script assignments from reaching the original enrollment.

Thanks to everyone who offered suggestions throughout the investigation.