Anyone else's Windows 11 devices stuck in a "pending" state forever?

I'd start by ruling out the time sync issue that's been mentioned, as it's a common hidden cause. The handshake failures in the log could easily be from a skewed system clock failing certificate validation, especially on virtual machines. Run that `w32tm /stripchart` check first.

If time is correct, then the cipher suite corruption theory others have raised is your next lead. Look for any GPOs or recently installed security software that might have reordered or disabled TLS 1.2 cipher suites. The agent is particular about what it can use.

I haven't seen evidence that hybrid AAD joins make this more likely, but they can add more policies into the mix that might cause the conflict.