We have configured our tenant with CA to require Hybrid AD Joined Windows devices. This all works great as long as the device has AzureADPRT set to Yes, and the Edge browser is signed in using the same account used to sign into Windows.
However, if e.g. as an admin you want to have a second profile signed in using your admin credentials, then even just logging into the Edge profile you get "you cannot access this from here", and in Azure AD sign ins you can see that no device information was passed, ergo not classed as Hybrid AD Joined.
I have found no way of getting around this without taking the user out of the CA altogether and allowing access from unmanaged devices. Even selecting only the workloads Teams, SharePoint, Exchange Online it will still block Edge from signing in the second user account into it's own profile.
Does anyone know how this is meant to work, as it seems a bit silly to prevent signing into the browser profile itself, which is a pre-requisite to being able to check if the device is compliant or hybrid joined in the first place?
