GlobalProtect SSO does not work on computers where login is done with a fingerprint. When users login with a fingerprint, GlobalProtect asks for the user name and password.
Cause
PAN-OS versions below 6.1 do not support this feature
Resolution
Use Extended SSO support for Windows in the bullets below:
This feature is available in PANOS 6.1 and an upgrade is required.
Also check if there is any credential provider software installed on those Windows computers that require fingerprint logon. Locate currently installed credential providers at the following location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Authentication\Credential Providers
Note: It is required to use the Windows Registry or the Windows Installer to allow GlobalProtect to wrap third-party credentials, as documented.
The following link provides steps to configure SSO with 3rd party credential provider (fingerprint in this case): New Features Guide 6.1 (English)