How to fix Hybrid Joined Intune enrollment error: Event Viewer ID 76, Error 0x82aa0008

To add context, I verified this information suggested by the initial AI response to this thread:

Perform these checks and fixes in order on the affected hybrid-joined device and user:

1. Verify Intune prerequisites for the user

• Confirm the user has a valid Intune (Microsoft Endpoint Manager) license assigned.
  • Business Premium for Non-Profits
• Confirm the user account is synchronized correctly between on-prem AD and Microsoft Entra ID (already stated as done, but this is a prerequisite for the remaining steps).
  • Yes

1. Verify automatic MDM enrollment configuration in Microsoft Entra ID

• In Microsoft Entra admin center, verify that automatic MDM enrollment is enabled for the users:
  • yes
• MDM user scope must be set to All (or at least include this user). If it is set to None, auto-enrollment fails and triggers Event 76.
  • User scope is set to all
• MAM user scope should be set to None; otherwise, it can take precedence over MDM scope and interfere with enrollment.
  • No MAM
• MDM discovery URL must be https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc.
  • Yes

1. Validate the user’s UPN and domain

• If the user’s UPN uses an unverified or non-routable domain (for example, user@contoso.local), auto-enrollment fails with Event 76.
  • Confirmed user has routable UPN
  • In on-prem Active Directory Users and Computers:
  • Open the user’s properties → Account tab.
• Ensure the User logon name UPN suffix is a valid, verified, routable domain (for example, contoso.com).
  • Verified UPN is valid in AD
  • For multiple users, bulk-change the UPN suffix to a valid domain.

1. Confirm device state and PRT (hybrid join health)

• On the device, run dsregcmd /status and verify:
• AzureAdJoined: YES
• DomainJoined: YES
• AzureAdPrt: YES
  • All of these show YES
• If AzureAdPrt is NO, there is a post-join authentication issue that must be resolved before MDM auto-enrollment can succeed. Use the hybrid join troubleshooting guidance to resolve any PRT or device authentication errors (for example, AADSTS50155, AADSTS50126, or network-related WinHTTP errors).
  • This shows as yes

1. Check for known hybrid-join and network issues

• If there are network-related WinHTTP errors (for example, ERROR_WINHTTP_TIMEOUT, ERROR_WINHTTP_NAME_NOT_RESOLVED, ERROR_WINHTTP_CANNOT_CONNECT, ERROR_WINHTTP_CONNECTION_ERROR), verify:
• The device can reach the Microsoft Entra and Intune endpoints.
• Any outbound proxy allows the computer account to discover and silently authenticate.
• If the device object or authentication is not yet fully synced (DirectoryError / AuthenticationError in hybrid join logs), wait for Microsoft Entra Connect sync to complete and retry.
  • These all work, they show no errors.

1. Re-run auto-enrollment after configuration is corrected

• After fixing UPN, MDM scope, and verifying hybrid join and PRT, force a Group Policy update (gpupdate /force) and then either:
• Reboot the device, or
• Manually trigger the scheduled task under Task Scheduler → Microsoft → Windows → EnterpriseMgmt → Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID.
• Check Event Viewer under Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin for a successful enrollment event instead of Event 76.
  • I have done these steps and still the issue persists.