After enabling seamless SSO, you need to roll over Kerberos decryption key every month or so.
Process is desribed on this site:
However, you can need to adjust your installation on the server to run AzureAD 2.0.
Here is the short tutorial:
And here the effect: