GlobalProtect SSO does not work on computers where login is done with a fingerprint. When users login with a fingerprint, GlobalProtect asks for the user name and password.
PAN-OS versions below 6.1 do not support this feature
Use Extended SSO support for Windows in the bullets below:
This feature is available in PANOS 6.1 and an upgrade is required.
Also check if there is any credential provider software installed on those Windows computers that require fingerprint logon. Locate currently installed credential providers at the following location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Authentication\Credential Providers
Note: It is required to use the Windows Registry or the Windows Installer to allow GlobalProtect to wrap third-party credentials, as documented.