At our ITOpsTalk: All thing Hybrid event, Steve Syfuhs shared the details of the Windows login process.
I've taken a portion of that - the authentication with Azure AD from a hybrid joined machine - added the application token request process and wrapped it up in a blog post for you, with direct links to the Docs resources:
https://techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-windows-hybrid-join-single-sign-on-...
