Users on Entra joined, Intune-managed devices can reach a share through the server's FQDN, but not through the domain-based DFS namespace. They're connected over VPN, and Kerberos tickets appear for the direct connection.
I've enabled UseFQDN and readded the namespace servers, but the namespace still fails. What else should I look at?
Check the actual server names in the namespace configuration export. A server name on its own is not an FQDN, even if the namespace path itself uses the domain name. The server target needs the domain suffix too, for example server.domain.com rather than just server.
UseFQDN affects referrals, but also check how the namespace server targets were added. Enabling it doesn't prove that every target in the configuration is already using a fully qualified name.
Check DNS on the VPN connection too. Run ipconfig and see which DNS servers the device is using, then check whether it can resolve the domain and the namespace servers. A direct server path working doesn't by itself prove that domain-based namespace discovery is working.
As a quick comparison, try the same namespace from a hybrid joined device on the local network. Also see whether the Entra joined client can browse the domain root and reach the namespace servers. That can help narrow down whether this is specific to the client or VPN path, or a broader namespace issue.
Answers are reviewed before publication.
offstage.index_6:
That was the bit I missed. I treated the short server name in the export as though it were already fully qualified.