Microsoft Intune / "Company Portal" integrates with the macOS system-wide SSO mechanism. Beyond just single-sign-on, this also helps the Microsoft-hosted websites (such as SharePoint and OneDrive) verify that the device is "trusted" so you don't get the annoying non-compliance banner:
Your organization doesn't allow you to download, print, or sync using this device
In Microsoft Edge (unsuprisingly) and Safari, this "just works." In Chrome, you can use the official browser extension. Firefox requires a policy settings change that isn't obvious since it's not in the UI.