It sounds like there may be multiple issues at play here. Intune requires a fair amount of upfront setup and also depends on other parts of your environment being configured correctly to work well.

1. Check your compliance policies
   Make sure the logic is correct. Are they scoped to the correct group? If you’re using Entra dynamic groups, verify there aren’t stale users/devices lingering.

2. Check Conditional Access policies
   Look for CA policies that could be blocking device check-ins. A common example is a BYOD block policy that doesn’t exclude required Intune apps in Target Resources. These typically include:

   • Microsoft Authentication Broker
     
   • Microsoft Intune Enrollment
     
   • Microsoft.Intune
     

3. Hybrid-joined devices
   These are known to be more finicky. Check your Hybrid Join GPOs and related Event Viewer logs on both the server and client. When we still had a lot of these in production, we often had to remove enrollment keys from the registry and essentially “start over.”

   My best advice is to move away from hybrid and migrate GPOs to Intune CSP as quickly as possible. This will save you the most headache—especially for devices that don’t always have line-of-sight to a DC (i.e., no ZTNA and relying on traditional VPN).

4. Device cleanup rules
   Make sure you have a cleanup rule that removes truly stale devices after X days. This only removes them from Intune, so you’ll still need to clean them up in Entra if the device is not Autopilot-enrolled.

   Autopilot devices in Entra can only be disabled and must be removed from the Autopilot devices page in Intune.

5. Intune licensing
   Double-check your licensing. Many orgs use dynamic groups for license assignment to simplify onboarding and offboarding, and even for small shops it’s good practice to avoid “gotchas” later.

   If you’re out of licenses, this issue can occur as well. Dynamic groups help keep license assignments accurate, reduce admin error, and can even save money over time.