IOS Enrollment Policys - User affinity with modern auth, does not work with Company Portal VPP

We'd been chasing this exact symptom for a few weeks, and I'm posting mainly so anyone searching for the "Invalid JWT token" error ends up here.

In the Entra ID audit logs (Register device / Add registered owner to device / Add registered users to device), every enrollment showed a Register device failure with ResultReason: Invalid JWT token. It was followed 11-35 seconds later by a successful retry under the same CorrelationId. Before the fix, that successful retry was what created the second, orphaned Entra device object instead of attaching to the Intune/ADE record. Company Portal then showed the device as not managed.

Deploying the app config XML that GT3 posted above fixed the duplicate

The Invalid JWT token failure still shows up on every enrollment, but the retry now attaches to the correct device record and Company Portal shows the device as managed. So if you're seeing Invalid JWT token failures followed by duplicate device objects on ADE devices using Enrollment Policies with user affinity + modern auth, this is likely your issue.