For anyone finding this in the future, you must push a VPN profile from the MX (it will ignore the AllowRemoteUsers setting configured locally in the VPN profile on the machine). A minimal profile you can push is: <?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>
</ClientInitialization>
</AnyConnectProfile>
... View more