So, the issue here is that devices that get enrolled in to Intune from SCCM, do not get enrolled with User Device Affinity. Without UDA, this causes things like a user not being able to use the Company Portal app (receive device not found error), BitLocker self service, and the issue you described.
If you come from the Intune side first, this issue does not exist, since when you enroll in to Intune with your credentials (as opposed to SCCM doing it), you build that UDA.
I opened a premier case on this issue and was told that there is no UDA by design, due to shared computers in an SCCM environment. They did say they understand the need but it is a design change and there would be no ETA for when this would be available/supported.
On a side note, another thing I have noticed with my PC's that SCCM enrolls in to Co-Management, is that the Intune Management Extension never shows up for them. Have you experienced this issue as well? I have a premier opened for this too.
