Support Tip: Understanding auto enrollment in a co-managed environment

dear all, 

our onboarding is working, but when we launch our client outside off the organisation network, we have some strange behaviour.

After login without vpn connection a popup show up. It is marked "deviceenroller" with text "work or school account problem".

Clicking on the popup result in an MFA popup.

Looking trough settings > work or school account > the active directory connected account > info > last attemted sync shows "sync wasnt fully successfull because we weren't able to verify your credentials"

We have excluded the following services for mfa prompting outside the organisations network.

Resource Microsoft Command Service

Resource Microsoft Activity Feed Service

Resource Microsoft Device Directory Service

but the problem remeans.

If somebody also had these problems and found a sollution

thank you very much