Microsoft Entra Domain Services provisioning fails: PowerShell connectivity timeout on TCP 5986

Are deploying Microsoft Entra Domain Services enabled for "Pay as you go" subscriptions?

for *.onmicrosoft.com in East US. Provisioning repeatedly reaches the replica-set stage, then enters a terminal Failed state.

The Activity Log reports:

Error testing domain controller connectivity through PowerShell.
A connection attempt failed because the connected party did not properly respond after a period of time,
or established connection failed because connected host has failed to respond 20.51.149.54:5986

The managed-domain subnet is a dedicated 10.250.0.0/24 subnet. I have verified it has no customer-created NSG, route table/UDR, subnet delegation, firewall, or Azure Policy assignment blocking it. The generated public IP/load balancer/NIC were left unmodified.

I also remediated an earlier prerequisite error by restoring the Domain Controller Services enterprise application The current failure remains the TCP 5986 timeout.

Has anyone seen this during managed-domain provisioning, or can advise on a supported customer-side diagnostic/remediation?