I found out SSO was broken. They had to login to every app using the same account. Twice per day because the token live was 4 hours "for security".
I found out it was because they published these apps as PWAs, making them more isolated than normal apps.
I asked the product manager and he says the issue is "with Apple and Google", not his department. When asked why he chose PWAs for the apps he said this was easier to deploy, saves them developer accounts and such.
Since I can't force him to change I found a workaround: SSO works in PWAs if you use Edge on a recent Android version on a Samsung tablet. Lucky me we had bought Samsung tablets (this was not a requirement when purchasing I looked it up, just luck).
I asked the Intune manager about this and they said the field engineers should just set Edge as default in stead of Chrome.
When trying this on a company tablet it said: "Edge disabled by X group policy". That guys' department set the policy...
After they removed this I asked why it wasn't the default browser and he said this wasn't possible. I challenged him on this by Googling the Intune manual to set the default browser.
Later they said they had raised a support ticket with Microsoft for this.
On the internal Wiki I found a document describing the problem. It was dated 11 months before I joined.