We are working with support now but it looks like the desktop application uses IE. If the security zone your internal domain falls into tries to pass SSO to the desktop app, it won't work because it is an external IE frame. That is why you get the bl...
We are having the exact same issue. We went down the ADFS road but everything looks to be configured correctly.It is just the desktop app internally. Did you find a solution?