It works really well. You have to connect to the DDNS assigned to the MX. If you want the user to see a "nice name" for connecting, then you can create a profile that you can upload to give that better user experience. I've created an online tool for this: https://www.ifm.net.nz/cookbooks/online-anyconnect-profile-editor.html For MFA you typically use something that supports push notifications, such as Cisco Duo or Microsoft Azure/Office 365. There is no direct integration with Office 365. For MFA, you configure an on-premise NPS server with the Azure MFA component.
... View more