User can surf with kerberos auth (member of allowed AD group) some minutes.
Then stoppt it with this request:
https://firewall.fqdn:8091/ntlmauth.html?2www.google.de
and empty page.
AD SSO is active.
No STAS, no Sophos endpoint.
Browser Edge.
Restart the browser lets work again until the next break.