For example, my admin account is found at both locations...

@akamenev47 has that account enrolled a Computer or Device in Jamf Pro, or been assigned as the user for one? If not they won't appear in Users yet. Searching users doesn't do an LDAP query, it's just a search of the users assigned to a device enrolled with Jamf Pro.

Thank you so much, I had no idea about this!

@akamenev47  The other place this caught me was checking "Authentication Required" in a PreStage.  If the user has not been assigned to a device, etc then they will not be able to authenticate.  I had to move to an enrollment customization using LDAP instead.

@ega Using "Authentication Required" should definitely do an LDAP query for authentication for users who have never previously enrolled a device with Jamf Pro. The only time I've seen that fails is when a user's AD password is in the "must change on next login" state.

@sdagleyjust bit me twice teaching a short course to our Site admins using 10.32.2 two weeks ago 

@ega You may want to open a case with Jamf Support to investigate. The "Authentication Required" option in a  PreStage Enrollment can definitely do an LDAP lookup of a user not previously associated with a device in Jamf Pro. If it couldn't my org's onboarding process wouldn't work.

@sdagley  So you are right.  My issue was not passing thru to my LDAP server but that the 2 users in question were not correctly provisioned in said LDAP.  Thanks for helping me clear that up!

@sdagley You are right.  Turns out the users that could not login were not correctly provisioned in our LDAP.  Thanks for pointing that out.