Is system-preferred first factor overriding Single Sign-On?

We observed the same behavior in our environment after the recent rollout. From our testing, it doesn't appear to be a PRT or SSO issue. The devices are still getting a valid PRT, but when system-preferred authentication is enabled, Edge prompts for a Windows Hello for Business gesture instead of silently using the existing PRT for Entra-authenticated web resources.

We also excluded a few test users from system-preferred authentication, and silent SSO was immediately restored, which matches what you've described. That makes it seem like this is an intentional change in the authentication flow rather than a configuration problem with device registration or PRT issuance.

Based on these observations, it looks like system-preferred authentication is now prioritizing Windows Hello for Business as the preferred first-factor authentication method, even in scenarios where silent PRT-based SSO was previously used.

I'm also interested to know whether Microsoft considers this expected behavior going forward, or if there's a supported way to retain the previous silent SSO experience while keeping system-preferred authentication enabled.