Morris Kurz Sure, you are welcome. Glad it got resolved. Microsoft Q&A has policy: Accept an answer that question authors cannot accept their own answers and hence I am posting your answer in case you like to accept so that it can benefit others facing similar issues.
Resolution:
We found that adding managed certificate failed with an error due to presence of a CAA record that does not authorize Digicert. Morris Kurz followed the steps described in DNS configuration and created a CAA domain record with the value: 0 issue digicert.com to resolve the issue.
I hope this helps.