One more way to do it, create a group policy for client machine to disconnect the AnyConnect VPN during the timeframe. ... View more

Bit of reading:   https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair     ... View more

You need to use SAML if you dont have any radius service like ISE that can forward your authentication to an MFA server.   Read here. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration ... View more

Thanks this does work. Might be an audit issue going forward. I appreciate your help.   ... View more