Pure Entra Joined Device with On-Prem ID Sync

We’re moving to pure Entra‑joined devices with Autopilot while still syncing our on‑prem identities to Entra. Everything is working well except for one issue: only the user who originally provisions the device can sign in. When I try to switch users and log in with another user’s full UPN, I get the error “The username or password is incorrect. Try again.”

I know the credentials are correct, since the user can sign in to other Microsoft 365 resources without any problems. I also created a policy to add the user to the local Users and Administrators groups, but that didn’t resolve it. Any ideas?