This was the initial failure to lookup the AzureAD user (different host identifier because it has reenrolled since)

{
  "hostIdentifier": "8bca743b-7701-4c3a-ae18-7cbf883ee711",
  "calendarTime": "Sun Aug 15 01:41:44 2021 UTC",
  "unixTime": "1628991704",
  "severity": "0",
  "filename": "process_ops.cpp",
  "line": "164",
  "message": "Failed to lookup account name XXXXX with 1332",
  "version": "4.9.0",
  "decorations": {
    "company": "YYYY",
    "host_hostname": "ZZZZZ",
    "username": "XXXXX"
  }
}