This sounds like an issue with SSO for non-persistent VDI. You'll need to determine if you're using Seamless SSO or Hybrid Joined Instant clones, and go from there.
Usually this occurs when using Hybrid Domain joined Instant Clones, and not having the conditional access policies configured to handle the MFA requirement. If you're using Seamless SSO, it may not be functioning, and SSO authentication may be failing.