After following the deployment guide here
I'm not getting prompted on the client to enroll, and when trying to enroll the options are grayed out. The client log Microsoft-Windows-HelloForBusiness/Operational errors out with
The device registration prerequisite check failed. (EventID 7200)
The Primary Account Primary Refresh Token prerequisite check failed. (EventID 7200)
Windows Hello for Business prerequisites check failed. Error: 0x8007051F (EventID 7054)
GPO, MFA, Certs and ADFS are set up. Service accounts all nominal, every step of the guide checked 10 times over. The errors don't seem to be documented, and something is missing. Please help!