Hi Folks, anyone using NS acting as a WAP with certificate authentication scope by AD group enabled in ADFS. There is a doc https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/adfs-proxy-wsfed/adfspip-compliance.html but as certificate authentication needs to be enabled on the VIP, it will have to be optional as this cert 2FA is scoped by AD group. Thanks!