hi there Hundley, William-P )) thanks for posting this on q&a,
lets force a credential sync in azure ad. u can use the 'invoke aadusersync' cmdlet in powershell. just run this command with admin rights
Invoke-AADUserSync -ObjectId <user-object-id>
grab the user object id from azure ad or use 'get azureaduser' if u need to find it. check if the user's device is azure ad joined or hybrid joined. sometimes the issue is on the device side, not the creds )) u can verify this in azure ad under 'devices'. check this, the old school 'dsregcmd /force' might help too. cmd as admin and run dsregcmd /force
this forces a device sync with azure ad. its not just for creds but can fix weird auth issues dsregcmd.
worth looking into the user's sign in logs too. sometimes the error details there point u right at the problem. go to azure ad, find the user, and check 'sign ins'.
this might help in other tools too, like if u're dealing with on prem ad sync. just saying ))
dont forget the classic 'log out and log back in'. sounds silly but it fixes things more often than u'd think :))
let me know if this sorts it out
Best regards,
Alex
and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer