Has anyone set up FAS in an environment where Entra Single-Sign on is configured? Is that supported somehow? Goal is for user to obtain a kerberos ticket without configuring the Kerberos Server mentioned in that article (It's not supported in forests with multiple tenants/customers).

FAS needs to connect to local AD for generating the smart card. If you are doing full Entra joined environment, that has different configuration that doesn't need FAS.

Hybrid joined VDA's, because the users need kerberos

CBA is handy for SSO inside the session for MS Apps. It's a pretty easy setup, you don't need to worry about publishing the OCSP if you have the cert life small enough. And MS reversed the elevation of cert based over other MFA options.

Biggest issue with CBA for us is when users gets a new phone, and has to set up MFA again without any MFA methods (removed from old phone) - then we still have to disable CBA for that user while they reconfigure MFA

You could try scoping the certificate based access to just the DC where the VDAs live with conditional based access (ironically CBA of CBA) then as long as the smart device is outside the DC site certificates won't be an option.

I thought yo could use Temporary Access Pass for such cases?