If you should enable SAML on the FDM, please be aware that the FDM will error out when you try to push the changes if the SAML certificate has the "ca-check" enabled. Unlike the FMC, the FDM does not have any option to turn that feature off, and the ...
I saw that, but I'm not sure if that would really be relevant as I think in Azure the NAT is applied somewhere else not on the firewall itself. And the fact that this happens only for some users leads me to think it is more related to AnyConnect clie...
The fact that you said it affects some users I wouldn't think it could be anything wrong with the firewall configs, I would rather think it could be something related to an incompatibility between the operating system/patch and that specific version ...
I don't believe that is supported:
https://bst.cisco.com/quickview/bug/CSCvs19613
Even if you try to use the Flexconfig that wouldn't work as I remember the crypto command is a blacklisted command.