Azure AIK enrollment fails 0x80190190 - Intel ODCA 2 CSME MTP PCH SVN 01 PTT CA missing from trust pool - blocking Call of Duty

Azure AIK enrollment fails with HTTP 400 / 0x80190190 ("No valid TPM EK/Platform certificate provided in the TPM identity request message") on Intel CSME MTP PTT platform, blocking TPM attestation for Call of Duty (RICOCHET Anti-Cheat, Season 4/5 enforcement).

This appears to be the same class of issue as previously reported here:

• https://learn.microsoft.com/en-gb/answers/questions/5929574/
• https://learn.microsoft.com/es-es/answers/questions/5962175/

Device / TPM details:

• TPM Manufacturer: Intel (INTC, id:494E5443), Platform Trust Technology (PTT)
• TPM Version: 2.0
• TPM Manufacturer Version: 700.19.5.1992
• EK certificate issuer: CN=www.intel.com, OU=ODCA 2 CSME MTP PCH SVN 01 PTT CA
• EK certificate valid until: 01/01/2050
• System: ASUS TUF GAMING B860-PLUS WIFI, Intel Core Ultra 7 270K Plus (Arrow Lake), BIOS 3002 (latest stable), Windows 11 Pro 25H2 (build 26200.8973)

Failing endpoint:

https://INTC-KeyId-77b63d9f8b73f5fbbd73ace7d8fbda37a6a7865f.microsoftaik.azure.net/templates/Aik/scep

Error detail (Event Viewer, Application log, Microsoft-Windows-CertificateServicesClient-CertEnroll, Event ID 87):

HTTP/1.1 400 Bad Request

Response body: {"Message":"No valid TPM EK/Platform certificate provided in the TPM identity request message."}

Client HRESULT: 0x80190190 (-2145844848 HTTP_E_STATUS_BAD_REQUEST)

Additionally, Microsoft-Windows-TPM-WMI Event ID 1040 confirms locally:

"Pre-attestation health checks confirm a failure in a critical component, and the device is not expected to pass attestation."

What has already been verified:

• TPM present, ready, and capable for attestation (tpm.msc: "TPM is ready for use")
• Secure Boot enabled, BIOS mode UEFI
• BIOS updated to latest available stable version
• TPM cleared/re-provisioned (regenerates the same EK signed by the same Intel CA - does not resolve the issue)
• Endorsement Key certificate present and valid (verified via Get-TpmEndorsementKeyInfo)
• Activision's own Secure Attestation Wizard reports "System compliant"

The failure occurs server-side when Azure AIK validates the EK certificate chain. The EK is issued by a relatively recent Intel On-Die CA (used in Core Ultra Series 2 / Arrow Lake platforms) that does not appear to be present in the Azure AIK trust pool.

Questions:

1. Has the trust bundle for OU=ODCA 2 CSME MTP PCH SVN 01 PTT CA (Intel On-Die CA) been received from Intel and added to the Azure AIK CA trust pool? If not, can it be?
2. Is there any supported client-side workaround, or is this purely a cloud-side trust update (similar to the prior Infineon CA 035/039/042 fix)?
3. Is there an ETA for resolution, given this is actively blocking ranked matchmaking access in Call of Duty for affected users?

Happy to provide additional diagnostic logs (TPMDiagnostics ekchainnv output, MeasuredBoot JSON, full CertEnroll event history) if useful.