My build agent VM is Ubuntu 20.04 LTS, it did not have DHCP
pre-configured when I made a snapshot.
It should have.
If the VM had a static IP address when you took a snapshot of it, all clones created from that snapshot will try to use the same network config when they boot. This should not work at all, even if you wait when deploying them.
What I think is ...
There's no functionality in the Windows SSTP client to specify any kind of scope of authority with a DNS server. You just get to tell the client what DNS server to use.
Were I in this situation I'd spin-up a standalone DNS server on your LAN with root hints or a forwarder to a public DNS server and a stub zone for the "ad.example.com" referring to ...
Just had the same issue - all domain accounts giving "incorrect password" error, local user account working fine - and a reboot fixed it for me.
I realize this question is several years old, but at least here's a fix that has actually worked for the problem described in this question, at least once!