Platform SSO + Secure Enclave: True Passwordless macOS Sign-in with Entra ID?

Hi all,

I'm testing macOS DEP/ADE + Intune + Platform SSO with Microsoft Entra ID.

I have the Mac successfully enrolling through ADE, becoming Entra joined, and users can authenticate against Entra ID.

With Platform SSO configured for Password authentication, users can sign in using their Entra password and everything works as expected.

What I'm trying to achieve is a passwordless experience using Secure Enclave, similar to Windows Hello for Business:

User enrolls the Mac via ADE
Device joins Entra ID
Platform SSO is registered
Authentication uses Secure Enclave / biometrics (Touch ID)
User is no longer prompted for their Entra password during normal sign-in/unlock scenarios

Has anyone successfully implemented this with Intune and Platform SSO?

Specifically:

Is a true Windows Hello-like passwordless experience currently supported on macOS with Entra ID + Platform SSO?
If yes, what authentication method and Platform SSO configuration are required?
Are there any known limitations where Entra authentication still requires the cloud password even when Secure Enclave is configured?

I'm interested in real-world deployments and lessons learned.

Thanks!