Depth of troubleshooting that ensued ...
... if you call Microsoft support, this is likely to stop at "what's the code, oh, reinstall windows and tell me if it fixes the problem". Really, I've had tons of this recently with Azure AD hybrid workstation joins and identity problems in Office 360 [beeeep] Microsoft 360 caused by broken AD Connect synchronisation between on-prem AD and Azure AD. One hapless support "Ambassador" gave me a link to paid Azure support, at $250/incident. I politely refused, as I've already paid for support in my Microsoft 360 licensing costs. I asked him to stop helping me and find someone else.
It is a world of pain, with remarkably little help from the provider of the software. Maybe I just need to pay for Enterprise Support to get sensible help. YMMV.