Let's say my company has an Azure AD "domainx.com".
I used Window 11 Pro and joined my laptop (device not account) to domainx.com. I entered my AAD account information and the machine joined up just fine. Everything worked until I logged out and tried to login with my email address. Every attempt to login says Invalid username or password. The creds are the exact same ones I used to login to join the machine to AAD. I try using firstname.lastname@domainx.com or firsname.lastname and either way it reports invalid creds.
I went digging in events at Application\Microsoft\Windows\AAD\Operational and found some info and error events like:
Info...
DoGetToken Diagnostic Event:
Result: 0xC004844C
User identity: firstname.lastname (not literally, no @domainx.com)
Credential Type: 1
Correlation ID: SOME GUID (changes between login attempts)
Error...
Login failure. Status 0xC004844C
Correlation ID: SOME GUID (changes between login attempts)
What settings should I be looking at to figure out why I can't login with the AAD account?
If I login with the local admin account I used to join the machine to ADD, and run  dsregcmd.exe /status to get some status
+---------------------------------------------+
| Device State                                                         |
+---------------------------------------------+
             AzureAdJoined : YES
          EnterpriseJoined : NO
              DomainJoined : NO
               Device Name : DESKTOP-BLAHBLAH
+---------------------------------------------+
| Tenant Details                                                       |
+---------------------------------------------+
                TenantName : domainx.com
                  TenantId : SOME-GUID
               AuthCodeUrl : https://login.microsoftonline.com/SOME-GUID/oauth2/authorize
            AccessTokenUrl : https://login.microsoftonline.com/SOME-GUID/oauth2/token
                    MdmUrl :
                 MdmTouUrl :
          MdmComplianceUrl :
               SettingsUrl :
            JoinSrvVersion : 2.0
                JoinSrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/device/
                 JoinSrvId : urn:ms-drs:enterpriseregistration.windows.net
             KeySrvVersion : 1.0
                 KeySrvUrl : https://enterpriseregistration.windows.net/EnrollmentServer/key/
                  KeySrvId : urn:ms-drs:enterpriseregistration.windows.net
        WebAuthNSrvVersion : 1.0
            WebAuthNSrvUrl : https://enterpriseregistration.windows.net/webauthn/SOME-GUID/
             WebAuthNSrvId : urn:ms-drs:enterpriseregistration.windows.net
    DeviceManagementSrvVer : 1.0
    DeviceManagementSrvUrl : https://enterpriseregistration.windows.net/manage/SOME-GUID/
     DeviceManagementSrvId : urn:ms-drs:enterpriseregistration.windows.net
+---------------------------------------------+
| User State                                                           |
+---------------------------------------------+
                    NgcSet : NO
           WorkplaceJoined : NO
             WamDefaultSet : NO
+---------------------------------------------+
| SSO State                                                            |
+---------------------------------------------+
                AzureAdPrt : NO
       AzureAdPrtAuthority : 
     AcquirePrtDiagnostics : PRESENT
      Previous Prt Attempt : 2022-01-27 22:26:39.919 UTC
            Attempt Status : 0xc004844c
             User Identity : firstname.lastname (not literally)
           Credential Type : Password
            Correlation ID : SOME-OTHER-GUID
             EnterprisePrt : NO
    EnterprisePrtAuthority : 
+---------------------------------------------+
| Diagnostic Data                                                      |
+---------------------------------------------+
        AadRecoveryEnabled : NO
    Executing Account Name : DESKTOP-BLAHBLAH\username
               KeySignTest : PASSED