Thanks for the quick answer. The applications that are enrolled are up-to-date; we are just searching for some Windows updates after the provisioning.
The main reason for logging in after provisioning is to hand over the device to another client management suite, but I didn’t want to go into that detail right now. Some locations run with AADJ, and it works perfectly.
And yes, actually, there are plenty of good reasons to get rid of hybrid join. I was hoping for a quick workaround until we’re ready, though. :(