Surface Hub (Windows 10 Team 2020) Auto-Enrollment?

We have some Surface Hub 2S devices as well as first generation Surface Hub devices that we want to auto-enroll into Intune.

It is a hybrid environment (user accounts and groups are on premises and then sync up to Azure with AD Connect, hybrid Exchange with mailboxes in Exchange Online).

We want to Azure join the Surface Hubs and have them auto-enroll into Intune.

The devices are showing in Intune, but no policies are applied.  The polices just show as “pending.”

What do we need to do to ensure the Intune auto enrollment is properly configured, complete, and make the assigned Intune device policies get past the pending state?