You will certainly need an SR to resolve this.  Most likely far more involved than the forums can handle.

If do....Post the SR# here....

But for Tips....

Start with a Simple Win11 VM w/o configuring anything other Credential Providers such as Microsoft MFA.  We want to ensure that it is working natively...Then we can work on getting it working with MS MFA.  But a case would certainly be needed...Just let me know when its made.

Thank you.

Tested today on hardware (so no vdi and MFA), Windows 10 22H2, zcm 23.3 (forgot to mention this before).

Logging in with UPN, same result. grey icon and sign in option.
Got all the attached application, when adding a bundle and after refresh bundle appears, so looks logged in. 
When you do a succesfull sign in from the icon, icon stays grey and sign in options still shows.

SAM account gives blue icon

Will make a SR in the morning.

SR is 02912220

I just posted an update to your case for your engineer....

Have the Customer get the output of the Kerberos Tester which was uploaded to his case.

Simply extract the Zip and run the EXE on the PC giving issues.

 Synyax is:

Krb5CasaTester.exe PrimaryServerIP 443 ZCMRealmName

 --

 Have the Customer see if the UPN and SAM Account Name are the same or different.

https://portal.microfocus.com/s/article/KM000004545?language=en_US

--

Note: The tool does not even require the ZENworks Agent to be installed.  It will still be able to test Kerberos Authentication.

So the first step is to see if Kerberos itself is working in your setup.

After that....We have to see if the Credential Providers are working after we get Kerberos tested.

--

Provide any technical feedback through the case and not here.....We need to make sure the assigned engineer is fully in the loop.

Hello,

Got an answer last night from support to use Kerberos because we have differen AM / UPN accounts, but realm is ok. In article it says AND. But maybe issue is something else

read the article again https://portal.microfocus.com/s/article/KM000004545?language=en_US and was more focused on the lines:

In cases where UPN is different than SAMAccountName and UPN domain name is different than the ZENworks Realm name ZENworks login will fail because the UPN is formed by CASA server appending the realm to the passed in username so the UPN suffix won't match.  In the case where this type of setup is required, it is suggested to use Kerberos authentication in addition to or rather than username / password.

But think the problem is that logging in to windows 10/11 we use as username  upnaccountname@ourdomain.nl. If this is passed through to zenworks I understand CASA adds another @oudomian,nl.  Am I correct? 

Or does this only happpen when you sign-in from zenworks icon in taskbar?

Logging in via the ZENworks Icon or the "Ctrl-Alt-Del" screen makes no difference in the details above.  The Logon Screen however mixes in Credential Providers which is an additional layer which may be a secondary issue....Try to keep the questions in the case....I'm following it there....We want to make sure the direct case owner is fully in the loop....