app.managed declaration never sent on account-driven User Enrollment (iOS 27), user licence Associated

app.managed declaration never sent on account-driven User Enrollment (iOS 27), user licence Associated

iPhone on iOS 27.0, account-driven User Enrollment, Microsoft Intune as MDM, Apple Business federated with Entra ID.

A Required App Store app (Microsoft Edge DDM) assigned declaratively with a user-based licence never installs.

Have tried with pages, Microsoft word, and same behavior is displayed.

What we've confirmed:

• Apps and Books API: the user licence is assigned to the MDM's user record, status Associated, no device assignments.
• On a fresh enrolment the device fetched the full declaration set (activations, a passcode configuration, status subscriptions incl. app.managed.list). The passcode configuration applied within seconds. There was no com.apple.configuration.app.managed.
• The device reported its empty app.managed.list status and the server acknowledged it. Syncs 30 minutes later: "Last declarations token received matches last one processed".
• The same app installs fine on the same phone via the classic InstallApplication command with a user licence, as an 'MDM' app in Intune.

So the device side looks healthy and the declaration is never generated. Questions:

1. Has anyone seen app.managed with a user licence work on account-driven User Enrollment, with any MDM?
2. Is there anything on the Apple Business or Managed Apple Account side that user licences need on User Enrollment, which an MDM might check before sending the declaration?
3. On User Enrollment, does Kerberos SSO extension traffic made for an app tagged with Attributes.RelayUUID go through that declarative relay, as Apple documents for per-app VPN?