AnyConnect SBL combined with SAML user authentication?

[webabc123]

We are configuring users to sign into AnyConnect using SAML SSO plus Duo MFA after logging into Windows. 

I have heard that this SSO method doesn’t work with the SBL users may need to use if they don’t have cached credentials. 

What options are available for pre-login VPN access for these users?

Can SBL be setup with a different profile that only accesses the login servers and uses machine certificates as authentication and then, after login, they disconnect and log in using their SAML SSO if they want to access additional internal resources?

Can Management VPN tunnel pre-logon be combined with SAML SSO after logging into their Windows profile?

Is there a better option? 

[joris.van.antwerpen]

Is there any progress on this? It would be very nice if the user can use the same SAML login page from the Windows Login screen, when using SBL. We now run into issues that after a password reset, still people cannot login to their laptop, as their reset domain password is not synced to the laptop. For that we need the VPN SBL feature, which doesn't support our SAML login.