This message was deleted.

SAML/FAS is the way to go - much better UX and allows for SSPR/MFA enrollment, password resets

agree and it is my preferred method also. requires additional components though when an NPS server might already be in place making NPS the easier option. If i can confirm CA wont work with NPS then i can take it off the table completely.

CA will not work - 100% I’ll find the doco on it - NPS handicaps CA with MFA