Think in layers

When investigating an endpoint issue, separate enrollment, management, configuration, application and compliance states. A device can be successfully enrolled while a later policy or application operation is failing.

Enroll → Manage → Configure → Deploy → Evaluate

Troubleshooting principle

Capture the device, user, policy, application and timestamp before changing settings. Then make the smallest controlled change possible and verify the result.