I'm in a similar situation. From what I can tell it comes from MacOS not being able to handle Azure's SAML authentication natively and requires a plugin (requires the use of an MDM platform like Intune with Company Portal). From the looks of it, the token is not properly being stored/converted to the correct URL that is sent back from the device. When I inspect the webpage with developer tools, I keep getting an error along the lines of "Failed to launch ‘anyconnectsso://<URL>’ because the scheme does not have a registered handler." From the research that I have done so far, it looks like it isn't replacing the anyconnectsso:// with https:// which then directs me to a blank page. I'm going to submit a TAC case to see if there is any way to modify the header for an alternate VPN profile for Mac machines, or if this is strictly an issue with how the machines process the headers. I've rarely touched MacOS, so I feel like there might be something done under the hood I'm not seeing.
Edit: I'm an idiot for not fully reading the error that you have. I also had a similar issue a few weeks ago at my job. The thing that prompted the error for us was due to a default browser being manually set, after we pushed out an update to remove Chrome so users would only be able to use Edge. Hopefully this is your solution. This also kind of leads into the issue that I am working on currently.
I've done some additional research. Some of the information that I've found was incorrect in the sense that the protocol isn't replaced by some variable. The anyconnectsso:// refers to a protocol "handler" that then redirects to an application. Like to how https:// will redirect you to your default browser, or how mailto:// will redirect you to your default mail application. So when the token gets passed to the browser, it doesn't know what application to apply it to since it isn't "registered" (like the error I got). Hopefully your issue doesn't cascade into this, but hopefully this can help provide next steps if manually influencing the browser doesn't.
