If your users accounts are hybrid, give pure Azure AD Joined devices a try. Very few things require Device authentication and hybrid-User authentication just works -- for most things. The only place we struggle is Windows will first try to authenticate the user with their modern auth token, when things like our RADIUS server and old web applications require username and password authentication.