If a tool is domain joined, that system is automatically entered into AD. So your policy might reference the pc organization instead of consumer institution page. You also can use EAP-TLS and use area certificates.