Device credential is not supported when performing GPO enrollments into MEM/Intune, it is actually blocked at the Intune service. Only user credential is supported when perform GPO enrollments, which also means you need to assign Intune license to your users also. https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy, see the big bold purple comment on step #5.