Can Entra only joined machines be a part of the "Domain" firewall profile. Or does that only include traditional domain active D joined computers?

No, they can only have the private or public profile applied

ok, so the wording does mean like active Dir domain? thnx

I have only ever seen the Domain firewall profile on domain joined machines

thanks, For some reason all my 365 desktop\cloud PCs are getting Public for their profile. Having a tough time finding where in intune I can apply the private setting to them. Have you seen that setting in intune ?

They can have a domain profile. You need to use “Network List Manager” and can be set in Intune https://petervanderwoude.nl/post/automatically-switching-the-windows-firewall-profile-on-azure-ad-joined-devices/