Sophos Chromebook User ID App - "Not connected"

Hi,

We're trying to get Chromebook SSO to work. We have configured XG following documentation available and uploaded the JSON and Certs into Google Workspace (GW). We've also force-installed + pin User ID App.

What we're experiencing though is the Sophos User ID App isn't detecting the logged in user. Our setup is:

Internal AD Domain: xyz.local
Email Domain: xyz.com
GW Domains: xyz.co.uk (default) and xyz.com
Google Cloud Sync is running and working
GW ADFS SSO to AD is working (we've configured Chromebooks to power on to ADFS sign-in screen, not GW's native one)
Chromebook SSO enabled on LAN and WiFi zones
Chromebook SSO configured:
->Enable: ticked
->Domain: xyz.local (tried xyz.com but not xyz.co.uk - does this have to be the AD domain or the GW domain?)
->Port: 65123
->Cert: Self-signed pointing to XG LAN IP address
->Logging: debug

When checking the User ID App the settings are pulling down ok. But when doing a Test:

Google: Access token OK (green tick)
UTM connection: Status: -1 Result: Network error (red cross)
Sign-in (red cross)

On the User ID App Dashboard:

Name, Domain, ID, User name: empty
Online: Yes
Connection status: Disconnected (clicking Connect does nothing)

Logs:

ERROR: Network; Connection error: {"type":"TransportError","description":0}

Any ideas?

Thanks