Jamf Connect created users (without enrollment customization), MDM capable users, and macOS 27

That seems to be the best option for now. You can save yourself from erasing the Mac though: https://philipross.github.io/posts/Retroactively-activating-user-channel/. Tried that few hours ago and it worked ok (except enrollmentComplete trigger on policies and conf. profiles being reapplied).

Same idea as ​@bartzach86’s article above to get ADE devices re-enrolled. I also use it for expired MDM profiles: https://ordonez.tv/2025/12/20/fixing-mdm-communications-with-apple-business-manager-migration/

I would also suggest enabling enrollment customization ( With Jamf Connect) or switching to PSSO (password method) for new devices.

For more context:

With the release of macOS 27, it appears that we will no longer be able to deploy system-level Accessibility TCC/PPPC configuration profiles. Instead, we will need to use user-level App Configuration declarations. The challenge is that when Jamf Connect creates a local account, that account is not MDM-capable. As a result, Jamf Pro cannot apply the required user-level configurations to the account, creating a potential management issue for environments that currently rely on Jamf Connect.