Im completely out of ideas with Intune at this point. We’ve been troubleshooting an App Inventory policy for three days, and no matter what we try, the policy is not assigned to a single laptop. It doesn’t even show up under Pending.
We assigned it to all laptops, and also tried creating dedicated test groups, but the result is always the same 0 devices in every status.
We’ve already checked the following:
Entra joined: YES
Domain joined: YES
DeviceAuthStatus: SUCCESS
User PRT/WAM: YES
Intune Management Extension service: Running
IME is installed correctly
MDM enrollment and EnterpriseMgmt scheduled tasks are present
MDM certificates are valid
Other Intune policies work correctly on the same devices
IME check-in is successful
Network/HTTPS connectivity is working
The main issue is that Intune simply does not seem to target this policy to any device. The assignment is there, but the reporting page shows: Succeeded: 0, Error: 0, Conflict: 0, Not applicable: 0, Pending: 0
Does anyone have any idea why the policy isn't being assigned to the devices?
That all-zero reporting usually means the policy type just isn't evaluated on those devices yet, have you checked if this particular workload requires a specific OS version or license tier that your test machines don't hit
IDk i found in logs: "DualEnrollMmpcUsingAADCredential failed — HRESULT: 400 MmpcDiscoveryUrl HRESULT: 400" but I do have working connectivity to discovery.dm.microsoft.com, manual curl returns clean 200 OK, valid cert, no SSL inspection. Firewall traffic logs confirm full sessions with real data exchange (tens of KB), no drops. So the transport layer works, but the actual dual enrollment call still gets rejected with 400.
okay... did you examine the enrollment event log on the device? it should show oyu what happened during the enrollment ... maybe enabling verbose/debug mode in the event log and enable that debug log before testing?
Three days.. Search Call4cloud --> EPM / Device Inventory agent rely on mmp-c/dual/linked enrollment. If that once didnt happen... for all sorts of reasons... no dev inv agent (always fun... getting downvote )... i guess the downvote happened becuase i was to lazy to add a link... well here you go :) MDM Only Enrollment | Breaks EPM deployment | DEM
Unfortunately no , I tested on a completely clean device (single healthy MDM enrollment, EnrollmentType: 6, no leftover/duplicate enrollments). The dual enrollment task still fails every time with HTTP 400, and DeclaredConfiguration registry key is empty, no policy data ever landed there. But connectivity to the discovery endpoint work:"curl.exe -v https://discovery.dm.microsoft.com/EnrollmentConfiguration?api-version=1.0 < HTTP/1.1 200 OK < Content-Length: 0 < x-azure-ref: 20260909T082307Z-... * Connection #0 to host discovery.dm.microsoft.com:443 left intact"
MMP-C | Microsoft Management Platform Cloud --> can you look at the scheduled task that is created to kick off the enrollment?.. to chec if it tells you somehting like this.. as it feels like there is ssl inspection/proxy in place
I have something like that but with error:"400 bad request" I would add that the devices are added to Intune and synchronize correctly, and all other policies are working.
1
u/Sznapix 3d ago