MCAS - Mac - certificate

So I use Cloud app security with conditional access on mac, where I supply root certificate and client then select the User certificate in the system keychain. Works fine mostly

But often I see on running clients like using Outlook or teams app that MCAS suddenly prompt to select certificate. There is only one certificate installed, so certificate is selected and then MCAS shows that access is blocked.

If I restart the app and login again, it typcically works again - or in worst cases have to restart the Mac fully. 

How can that be and it is an on-off problem, that happens randomly to clients