anonymous user, Thanks for posting in our Q&A. From your description, it seems we have exclude the SCCM client via Intune. But we still find the device with SCCM client installed. If there's any misunderstanding, feel free to let us know.
On the application in Intune portal, it shows exclude, not installed. Then I go to do more research.
Based on my research, I find there's a method to enable client push through SCCM which will install SCCM client automatically. Maybe this is our cause. When the device join to on-premise domain and is discovered by SCCM, the device may auto install SCCM client. Given the situation, please check if automatic client push installation is configured in our environment.
https://enterinit.com/sccm-automatic-client-push-installation/#:~:text=SCCM%20Automatic%20Client%20Push%20Installation%201%20Start%20SCCM,site-wide%20client%20push%20installation.%20...%20More%20items...%20
Note: Non-Microsoft link, just for the reference.
Hope it can help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.