For 85 users - don't even think about using the Microsoft client.  You'll be buying yourself a support nightmare.   Stick with AnyConnect.  The most common configuration these days is SAML authentication directly against AzureAD (aka Office 365).  No servers required. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration    Here is a list of other authentication options, including SAML options against things other than AzureAD: https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication  ... View more

We use the single ended core design as we have multiple internet and MPLS connections (four in total) that the SD-WAN connections run over.  You cannot do this in routed mode as there are only two WAN ports usable at a time with the current firmware. ... View more

When it has a single interface it can't act as a traditional firewall allowing traffic to flow between two ports BUT it is still a firewall in the sense that it is protected from threats, and you can directly connect it to the Internet (although that really isn't the case with Azure since Azure is NATing from the public IP it assigns to the private IP that it gives the VMX). ... View more