u/Delicious-Fun8282

I'm setting up Apple Business, done domain federation and Entra ID sync but I can't get my test phone (enrolled using Apple Configurator app) to do SSO.

intune has an apple enrollment token and profile setup

I can see the user in the people section as Staff, the phone accepts my email, goes to SSO and then shows an error: "email is a managed apple account. Maanged Accounts can only be signed in under Settings > General > Device Management & VPN.

what am I missing here that is not enrolling my phone?