I was getting information together and I realized my mistake. I’ll document my stupidity here in case someone else stumbles across it.
We’re moving all our Windows clients to being managed and existing in Microsoft Entra only. That means on a Windows client trying to ssh into a domain member server, you need to explicitly specify a domain user in your connection command/config instead of just relying on stuff passing through automagically and/or long-ago configured tools that take this into account.
Yah. I blame the lack of caffeine and my purposeful avoidance of Windows. >.<