Login Issues after Entra ID Join

Hi all, I'm testing migration from Workspace ONE to Intune in an Okta-federated Entra ID environment.

Issue:

1.Device successfully Entra joins and enrolls to Intune

2. \`dsregcmd /status\` shows \`AzureAdJoined = YES\` but \`AzureAdPrt = NO\`

3. PRT acquisition fails with \`0xc0004bc1\`

4. Users cannot sign in at Windows login with federated credentials (only local admin works)

This also happens on fresh Autopilot/clean enrollments, not just migrated devices.

Has anyone seen Okta federation / device trust / conditional access configurations cause Windows PRT issuance failures on Entra-joined devices?