Network Admin Users cannot update the OS

Several of our MacBooks will not accept network user credentials for OS updates (to Sonoma from Monterey or Ventura). Clicking the available update button shows the requester and populates the user's name, but it loops back to the requester again instead of starting the update when they enter their password. The user is listed as "mobile, admin" in Users & Groups and doesn't appear to be blocked from other activities requiring admin permission. We can do the updates by using the local admin account credentials, which means an IT staffer needs to visit them. We are joined to an AD domain.