Hybrid join succeeds but primary refresh token missing

Scenario

A Windows device appears joined correctly, but users do not receive SSO because the primary refresh token never issues.

Run dsregcmd status and compare device registration versus user sign-in state.
Verify proxy, TLS inspection, and time synchronization on the endpoint.
Check whether the user profile was created before hybrid join completed successfully.
If only one device model is affected, compare image baselines and enrollment timing.

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.

Subjects