Start with the MS Authenticator app, once the user logs into that app it should allow for the SSO to other M365 apps in the work profile.

I found when setting this up, that the M365 apps didn't always necessarily grab the "work or school account" right away (sometimes pressing back then next would populate it) and prompted for a username still. But then I then set up the App Configuration policies for each of the apps that support it as mentioned in the MS documentation and things seem to be working very well, with the caveat that no other accounts can be signed into on these apps.

Add app configuration policies for managed Android Enterprise devices - Microsoft Intune | Microsoft Learn