Diagnose and conservatively repair Windows Intune MDM enrollment failures where Hybrid Microsoft Entra identity is healthy but local enrollment state is incomplete or orphaned, such as missing core Enrollments records with surviving EnterpriseMgmt tasks, OMADM branches, an expired MDM certificate, and no Intune managed-device record. Use for Datto/SYSTEM audit and exact enrollment-ID cleanup. Do not use when DeviceAuthStatus is FAILED or the Entra device is disabled/deleted.
