I think to make this work you would need to create a DNS like "vpn.company.com" and set the TTL to something like 60s, and point that to both of the VMX. This would make clients alternate between them. If one failed, clients would drop. They would get a different DNS entry on average 30s later, and be able to reconnect (at least after a couple of attempts).
You could make it more sophisticated by using a DNS system that can dynamically add and remove entries based on them responding.
HOWEVER, the altogether much better system would to to us Cisco Secure Client with AnyConnect. It supports SAML authentication natively against EntraID (and can use its MFA), and it also has the concept of a backup server. It will automatically reconnect if the primary VMX is down.
https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SA...
