Greetings,
We have a working Anyconnect and FTD VPN setup that uses ISE and NPS to perform identity based authentication and MFA. The shortcomings for this setup is that it doesn't perform machine validation/authentication meaning that from any device the user can perform VPN request if the have the AnyConnect software. I'm looking into SAML to perform the user authentication and machine validation using "conditional access" and ISE as an authorization server, but i'm not sure that it will as I imagine How do you target this concern in your setup ? Do you have any best practice to follow ?
