Nine times in ten it is the MDM certificate, and you can rule that in or out in under a minute.
Start at the certificate
Check the enrollment certificate expiry before anything else.
Once you have confirmed the policy is reaching the device, the next state to rule out is a collision between two policies rather than a delivery failure. The resolution rules differ by policy type, and the report uses one word for all of them: which policy actually wins in an Intune policy conflict.
If the device itself is healthy but a script or a Win32 app is what has not arrived, the responsible component is a separate agent on its own eight hour cycle. Start with what installs the Intune management extension and where it writes its logs.
n
Where a device is reporting normally but the wrong person is attached to it in Company Portal, the field to look at is not sync at all. It is the Intune primary user, which Intune stamps once at enrolment and never revises on its own.
