Android Enterprise MAM auto-enrollment repeatedly fails for third-party app (com.talonsec.intune.talon) despite correct App Protection Policy and App Configuration Policy targeting

We are deploying a third-party Android app (Prisma Browser for Intune) that integrates the Microsoft Intune App SDK for MAM enrollment. The app is correctly deployed, assigned, and targeted by both an App Configuration Policy and an App Protection Policy, both scoped to the same Entra security group as the app deployment. Despite this, the app fails to complete MAM registration on first launch, and continues to fail on every subsequent attempt — including after a full device work-profile teardown and clean re-enrollment.

Policies in place:

1. App Configuration Policy — "PAB Mobile - Management Key," Platform: Android Enterprise, Profile Type: Personally-Owned Work Profile Only, targeting com.talonsec.intune.talon directly. JSON payload confirmed correct:
   App Protection Policy — "PAB Mobile - MAM Policy," Platform: Android, app targeted under Custom apps as com.talonsec.intune.talon (this app does not appear in the Public apps catalog search, hence Custom apps was used). Standard data protection, PIN, encryption, and conditional launch settings configured.
2. Both policies are assigned to the same Entra security group as the app deployment; group membership for the test user has been directly verified in Entra (not assumed).

What's already been ruled out:

• Conditional Access: Reviewed sign-in logs for this app/user across multiple attempts. Confirmed MFA is being satisfied (Authenticator approval succeeds). CA policies (including CA-09 Secure Intune Enrollment, CA-01 MFA For All Users) have been reviewed and temporarily tested in Report-only mode; the registration failure persists even with all Conditional Access effectively bypassed.
• Per-user MFA conflict: Confirmed disabled for this user (legacy per-user MFA is off; MFA is CA-policy-driven only).
• Licensing: User has Microsoft 365 Business Basic, Microsoft Intune Plan 1, and Azure AD Premium P1, all active and correctly assigned.
• Profile type mismatch: Confirmed device enrollment shows "Android (personally-owned work profile)," matching the App Configuration Policy's Profile Type setting.
• Group assignment mismatch: Verified directly in Entra that the test user is a member of the assigned group for all three policies (app deployment, App Config, App Protection).
• Stale/duplicate device records: Identified and removed orphaned MAM registration entries under old device IDs (from earlier troubleshooting cycles); performed a full work profile removal and clean re-enrollment from Company Portal, followed by a fresh app install. Failure persists on the fresh enrollment.
• App Protection Policy Monitor status: At one point showed "Protected" status for this exact app/device/policy combination — meaning registration briefly succeeded once — but broke again after the user logged out, and has not succeeded since.

Direct evidence from Company Portal diagnostic logs (OMADM): Pulled via Company Portal → Settings → Get help → Email logs, immediately following a reproduced failure. The following lines repeat continuously over an extended session (~15 minutes, timestamps 02:42:42 through 02:52:52 in the log):

Evaluating auto-enrollment for: com.talonsec.intune.talon
Package com.talonsec.intune.talon is allow-listed for auto-enroll despite being a single-identity app
enrollment not found for com.talonsec.intune.talon, user User<empty>.1197367290
com.talonsec.intune.talon is not a managed app; disallowing prefetchCurrentFileEncryptionKey
Not returning app config for User159014592.1197367290 because it wasn't found.

This shows the OMADM/MAM service correctly identifying the app as eligible for auto-enrollment (allow-listed), and repeatedly attempting evaluation, but the enrollment record is never successfully created or persisted, and consequently the App Configuration payload is also never delivered to the app.

Specific ask: Please investigate why MAM auto-enrollment evaluation for com.talonsec.intune.talon on this tenant/device/user repeatedly returns "enrollment not found" despite being allow-listed and despite correct App Protection Policy and App Configuration Policy assignment. We need to understand whether this is: (a) a backend enrollment service issue specific to this app/tenant combination, (b) a known limitation or requirement specific to single-identity Android apps using MAM auto-enroll, or (c) something else on the service side not visible from client-side configuration.

1. App Protection Policy — "PAB Mobile - MAM Policy," Platform: Android, app targeted under Custom apps as com.talonsec.intune.talon (this app does not appear in the Public apps catalog search, hence Custom apps was used). Standard data protection, PIN, encryption, and conditional launch settings configured.
2. Both policies are assigned to the same Entra security group as the app deployment; group membership for the test user has been directly verified in Entra (not assumed).

What's already been ruled out:

• Conditional Access: Reviewed sign-in logs for this app/user across multiple attempts. Confirmed MFA is being satisfied (Authenticator approval succeeds). CA policies (including CA-09 Secure Intune Enrollment, CA-01 MFA For All Users) have been reviewed and temporarily tested in Report-only mode; the registration failure persists even with all Conditional Access effectively bypassed.
• Per-user MFA conflict: Confirmed disabled for this user (legacy per-user MFA is off; MFA is CA-policy-driven only).
• Licensing: User has Microsoft 365 Business Basic, Microsoft Intune Plan 1, and Azure AD Premium P1, all active and correctly assigned.
• Profile type mismatch: Confirmed device enrollment shows "Android (personally-owned work profile)," matching the App Configuration Policy's Profile Type setting.
• Group assignment mismatch: Verified directly in Entra that the test user is a member of the assigned group for all three policies (app deployment, App Config, App Protection).
• Stale/duplicate device records: Identified and removed orphaned MAM registration entries under old device IDs (from earlier troubleshooting cycles); performed a full work profile removal and clean re-enrollment from Company Portal, followed by a fresh app install. Failure persists on the fresh enrollment.
• App Protection Policy Monitor status: At one point showed "Protected" status for this exact app/device/policy combination — meaning registration briefly succeeded once — but broke again after the user logged out, and has not succeeded since.

Direct evidence from Company Portal diagnostic logs (OMADM):
Pulled via Company Portal → Settings → Get help → Email logs, immediately following a reproduced failure. The following lines repeat continuously over an extended session (~15 minutes, timestamps 02:42:42 through 02:52:52 in the log):

Evaluating auto-enrollment for: com.talonsec.intune.talon
Package com.talonsec.intune.talon is allow-listed for auto-enroll despite being a single-identity app
enrollment not found for com.talonsec.intune.talon, user User<empty>.1197367290
com.talonsec.intune.talon is not a managed app; disallowing prefetchCurrentFileEncryptionKey
Not returning app config for User159014592.1197367290 because it wasn't found.

This shows the OMADM/MAM service correctly identifying the app as eligible for auto-enrollment (allow-listed), and repeatedly attempting evaluation, but the enrollment record is never successfully created or persisted, and consequently the App Configuration payload is also never delivered to the app.

Specific ask:
Please investigate why MAM auto-enrollment evaluation for com.talonsec.intune.talon on this tenant/device/user repeatedly returns "enrollment not found" despite being allow-listed and despite correct App Protection Policy and App Configuration Policy assignment. We need to understand whether this is:
(a) a backend enrollment service issue specific to this app/tenant combination,
(b) a known limitation or requirement specific to single-identity Android apps using MAM auto-enroll, or
(c) something else on the service side not visible from client-side configuration.