cannot login to azure ad joined computer

NOTE: As is typical with Microsoft technologies, there exist several methods to register and/or join a device to Azure AD. In this example, we'll register an Apple iPhone with my TIMW.INFO Azure AD organization. Let me walk you through one way to register an endpoint device with Azure AD. Intune is part of a larger Microsoft MDM platform called Microsoft Endpoint Manager. Microsoft's primary MDM tool is Microsoft Intune. While Azure AD Premium gives Azure AD registered or joined devices SSO to your cloud apps, you'll need a first- or third-party mobile device management (MDM) product to enforce policies such as data encryption, remote wipe, and so on. Users here can sign in to their device by using either a local device ID (for instance, their Apple account on an iOS device) or their Azure AD identity. An Azure AD-registered device is 'lightly managed' by Azure AD admins. Thanks for all the info and suggestions that have been mentioned.For BYOD, Azure AD gives us Azure AD registration. This created a mess because the attacker sent out 100’s of emails from the account.

I don’t think their lying, they just didn’t even realize they were phished.

Update: After reviewing logs it looks like credentials were phished then an MFA approval by the user. Has anyone seen behavior like this before? An iPhone was mysteriously added as an authentication method on the account. The strange thing I noticed is that the audit logs show a change in authentication methods at the time of the login. I tend to believe them since we have the numbers matching and location based settings turned on for Authenticator and I would think they would remember typing in the numbers. The user tells me that they didn't receive or approve any notifications. From looking at the logs, I can see the login attempt from a remote location and a Authenticator MFA notification was approved. Didn't know until I got an email that the user was blocked for spamming. I had a user account hacked in 365 yesterday.

Cannot login to azure ad joined computer