Is system-preferred first factor overriding Single Sign-On?

Your test suggests system-preferred authentication is selecting Windows Hello for Business, but that does not mean the Primary Refresh Token is disabled. A valid PRT can still provide SSO through the Windows broker. The prompt more likely means this request requires fresh or stronger authentication instead of accepting the existing session silently.
Compare a prompted sign-in with a silent one in Entra sign-in logs. Review Authentication Details, Conditional Access, resource, client app, and any fresh-authentication requirement. On the device, run dsregcmd /status and confirm AzureAdPrt is YES. Test both a normal Edge profile and InPrivate to separate PRT behavior from browser cookies.
Keep the exclusion scoped while investigating; do not disable system-preferred authentication tenant-wide yet. If the logs show no policy difference, open a Microsoft support case with the correlation IDs, timestamps, device registration state, and rollout configuration.