AAD BrowserSignin on untrusted device and SSO to office.com

Johannes Goerlich  Hello!  Thanks for reaching out!  We've discussed your question with the team and the scenario described is to be expected and is by design.  

To block sign in from untrusted devices, the team recommends using Conditional Access, like you've mentioned in your post.  Please see our documentation for more information: https://docs.microsoft.com/en-us/deployedge/ms-edge-security-conditional-access.  Thanks! 

-Kelly