Persistent Error 80090034 "Cannot be Encrypted" in Company Portal and Azure VPN Sign-In

Question

Hello,

I'm facing a persistent issue with the error code 80090034 "Cannot be encrypted" across multiple devices when trying to sign into the Microsoft Company Portal or Azure VPN. This error seems related to the Trusted Platform Module (TPM) but is recurring despite various troubleshooting efforts.

Detailed Steps and Context:

• Initial Setup: Begin by logging into the device as a local administrator.
• Disconnect Work Account: The first step involves disconnecting from any existing work or school accounts.
• Install and Connect Azure VPN: Install the Azure VPN and connect to the Domain Services via VPN.
• Domain Onboarding: Join the laptop to our domain managed through Microsoft Entra Domain Services using the connected VPN.
• Restart the Device: After joining the domain, the device is restarted to apply settings.
• Reconnect Work Account: Once the device restarts, I reconnect the work account while still logged in as the local admin. At this point, everything appears to be configured correctly.
• Issue Arises: However, after switching to the work account and attempting to log into the Company Portal or Azure VPN, I encounter the error 80090034.

Additional Details:

• Environment Setup: Our domain is managed through Entra Domain Services, with an Azure VM administering the domain controller. This configuration integrates with Microsoft Entra Identity for identity management and Microsoft Intune for device management. All work accounts are part of the Microsoft 365 Business Premium subscription, which might influence the available features and configurations.
• Successful Connection on Admin Account: My own device, using my global admin account, was connected back to the work account without any issues after domain joining. This process does not work the same for other user devices.
• TPM Status: The TPM is shown as "ready for use" with no errors indicated when accessed via tpm.msc.
• Troubleshooting Done: I've updated TPM drivers, cleared the TPM (with data backup), ensured the latest Windows updates, and re-registered devices in Entra ID.

Questions:

1. Has anyone experienced a similar issue, particularly involving error code 80090034 during Company Portal or Azure VPN logins?
2. Could there be specific configurations within Entra ID or Intune that might be conflicting with TPM operations related to device encryption or sign-in processes?
3. Are there any additional troubleshooting steps or configurations that might help resolve this error?

I am not an IT professional, but I have to resolve this on my own. Any insights or suggestions would be greatly appreciated. Thank you in advance for your assistance!