Event details
You mentioned that autopatch doesn't apply the cert that a task does, what task?
Autopatch just installs the LCU. If your device is high confidence, the Secure-Boot-Update task will apply the certificates on next boot. If not, you have to set the AvailableUpdates registry key via one of the supported ways (Group Policy, Intune, WinCS, manually) to trigger the secure boot updates like on any other machine not managed by Autopatch.
TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
