Error during device registration: Invalid JWT token

[dkattan]

Error during device registration:

{"ErrorType":"AuthenticationError","Message":"Invalid JWT token.","TraceId":"ebdf125c-369d-41e9-8bcd-34b43027dbf2","Time":"07-28-2025 19:25:39Z"}

Here is a decoded JWT from a failing attempt:

{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "JYhAcTPMZ_LX6DBlOWQ7Hn0NeXE",
  "kid": "JYhAcTPMZ_LX6DBlOWQ7Hn0NeXE"
}.{
  "aud": "urn:ms-drs:enterpriseregistration.windows.net",
  "iss": "https://sts.windows.net/fe55f06e-9f48-4dfe-af8b-3bdefdf54f81/",
  "iat": 1753729770,
  "nbf": 1753729770,
  "exp": 1753735407,
  "acr": "1",
  "aio": "AWQAm/8ZAAAAyXju2unHQNyBRFhPwxlz3iqFWT7qQjnP689/MoQxys4ZKZCe7/hB3rduSkwTon1b2I+q8UtogogdrY4cQQQfBZ7q0PoY8/aa2UCMP76Xdd/nhBQLe2wZpCYLr+fEF2FW",
  "amr": [
    "pwd"
  ],
  "appid": "12205cc6-aa41-4cd8-906d-203f33fa6d78",
  "appidacr": "1",
  "auth_time": 1753730069,
  "groups": [
    "0f268f69-6f0d-40e2-9fd2-b4e50bbd6725",
    "a124d757-054e-41e2-94fb-e6604627ec44",
    "b5d4ea82-1492-4bb9-b79c-07e31373a189"
  ],
  "idtyp": "user",
  "ipaddr": "23.116.114.9",
  "name": "Device Enrollment Manager",
  "oid": "0ab68bd6-e4ab-4a43-9b04-eeb2a4653e2f",
  "puid": "1003200251227A94",
  "rh": "1.ASwAbvBV_kif_k2vizve_fVPgXYoywG9fqRKnMnSi9TTWaksAGgsAA.",
  "scp": "self_service_device_delete",
  "sid": "006f1d69-b8ea-b4a0-399c-7d8eceea177d",
  "sub": "6nSTnu0wyqT7s95p6aA1Mnk2yn4v3NvN_Ed5r5YEV4o",
  "tenant_region_scope": "NA",
  "tid": "<omitted>",
  "unique_name": "<omitted>",
  "upn": "<omitted>",
  "uti": "z8MSWlRMNkuECulmIhWcAA",
  "ver": "1.0",
  "wids": [
    "7698a772-787b-4ac8-901f-60d6b08affd2",
    "b79fbf4d-3ef9-4689-8143-76b194e85509"
  ],
  "xms_ftd": "I5n9hWU4nQIY2t_ImH6140HetQiOH4Fv53qe9ZFCJL4BdXNlYXN0LWRzbXM",
  "xms_idrel": "1 30",
  "xms_sk": "true",
  "xms_sptype": "0"
 }

Here is a decoded JWT from a working attempt:

{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "JYhAcTPMZ_LX6DBlOWQ7Hn0NeXE",
  "kid": "JYhAcTPMZ_LX6DBlOWQ7Hn0NeXE"
}.{
  "aud": "urn:ms-drs:enterpriseregistration.windows.net",
  "iss": "https://sts.windows.net/fe55f06e-9f48-4dfe-af8b-3bdefdf54f81/",
  "iat": 1753735343,
  "nbf": 1753735343,
  "exp": 1753740922,
  "acr": "1",
  "aio": "AWQAm/8ZAAAAoJSXoM3kz4BqGsgdPlbOOX7V9oOr8q3IW4elFAe/D1NL0j93o32FOdgwAqcaKOKogtnwYlXexG65VI4RPMqhEs5PaV0xezKVh3YvnlFpnqxeSRTcsQMXHL6aiKv09F6/",
  "amr": [
    "pwd"
  ],
  "appid": "12205cc6-aa41-4cd8-906d-203f33fa6d78",
  "appidacr": "1",
  "auth_time": 1753735514,
  "groups": [
    "0f268f69-6f0d-40e2-9fd2-b4e50bbd6725",
    "a124d757-054e-41e2-94fb-e6604627ec44",
    "b5d4ea82-1492-4bb9-b79c-07e31373a189"
  ],
  "idtyp": "user",
  "ipaddr": "23.116.114.13",
  "name": "Device Enrollment Manager",
  "oid": "0ab68bd6-e4ab-4a43-9b04-eeb2a4653e2f",
  "puid": "1003200251227A94",
  "rh": "1.ASwAbvBV_kif_k2vizve_fVPgXYoywG9fqRKnMnSi9TTWaksAGgsAA.",
  "scp": "self_service_device_delete",
  "sid": "006f1d69-06bb-21d3-330b-0f3f3e96e0eb",
  "sub": "6nSTnu0wyqT7s95p6aA1Mnk2yn4v3NvN_Ed5r5YEV4o",
  "tenant_region_scope": "NA",
  "tid": "<omitted>",
  "unique_name": "<omitted>",
  "upn": "<omitted>",
  "uti": "OsMaaYSX00-dmTpxnKuCAA",
  "ver": "1.0",
  "wids": [
    "7698a772-787b-4ac8-901f-60d6b08affd2",
    "b79fbf4d-3ef9-4689-8143-76b194e85509"
  ],
  "xms_ftd": "p6EIUDWDx_hxXA-Zilq_rSjL4ijxGN8ZkICf548krLMBdXNzb3V0aC1kc21z",
  "xms_idrel": "4 1",
  "xms_sptype": "0"
}

The only notable difference is the bad one has "xms_sk": "true"

The only place on the entire internet that has a mention of it is this other issue

I'm not sure if this is a red-herring.

Any ideas @NestoriSyynimaa ?