First verify the user's VPN is working and active. If that looks OK, continue below.

Check the user's Account Type in Settings > Accounts > Your info. Make sure it's listed as a Local Account & Administrator, and ideally named Staff

We primarily see this happen on new laptops when the user created a Microsoft account while setting up Windows for the first time. If you see a work email listed instead of Local Account, convert it to a local account and rename the local user to Staff.

The user can set their own password & can set up a Windows Hello PIN after signing back in under the new Staff user.