This message was deleted.

In my experience the only process to use WAM with Windows 2019/Office 365 is to just prepare your users for a lot more O365 Auth prompts, as every environment I've seen has had to disable WAM to preserve the seamless sign on user experience.

Well, the point is after December 2022, ADAL will no longer be getting any security updates, and at some point an Office update will remove it completely so people will have no choice but to switch their environments to use WAM, I'm trying to figure out what's involved as it seems like the documentation is very lacking...

If you hybrid-join your devices I am pretty sure you will get SSO and auto activation of Office Apps, Teams, OneDrive and Edge

Yes I always make a Hybrid join to bring back the sso experience. But with saml and fas in your environment you don't get any prt, if you Logik over the das with a cert. Ms is working on this. at least that's what they told me

Is it a requirement for a machine to be Azure AD joined (or Hybrid Azure AD joined) to use WAM? if that's the case then none of our machines are using WAM, including standalone Windows 10 machines..

According to this article you will have to at least do an Azure AD device registration and add a work/school account to be able to receive the PRT https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token#key-terminology-and-components