So of course its solved , checking the prevent account creation when authenticating to yes.
authpreventaccountcreation
Default: No
When a user authenticates, an account on the site is automatically created if it doesn't yet exist. If an external database, such as LDAP, is used for authentication, but you wish to restrict access to the site to users with an existing account only, then this option should be enabled. New accounts will need to be created manually or via the upload users feature. Note that this setting doesn't apply to MNet authentication.
authpreventaccountcreation
Default: No
When a user authenticates, an account on the site is automatically created if it doesn't yet exist. If an external database, such as LDAP, is used for authentication, but you wish to restrict access to the site to users with an existing account only, then this option should be enabled. New accounts will need to be created manually or via the upload users feature. Note that this setting doesn't apply to MNet authentication.
I was so worried about corrupting the AD, when integrating Office365, that anything with the words external database or LDAP I said no and went with default (after years of it working fine in a configuration I set up!!)
Of course as I drilled into it, all a flutter, --- did I scroll past ldap or openidconnect and read under all the authentication options???
I, of course did not.
A simple solution and I am kicking myself - it took a fresh pair of eyes from a non Moodle person to see it.
It is a salient lesson that the more sophisticated we get with the innards of this project, the more forest we see, the simpler trees often hide in plain view.
If you have read this and had a laugh please respond, I guess we are feeling all a bit isolated and hugely responsible for others at the moment.