Azure is a supported IDP in SAML authentication instance, and the issue is not related to Azure configuration itself, however must be with the VPN server config.
@yutsi That's good news, I am glad to know that it worked 
It striked me when you said it doesn't proceed further after logging to the IE page... since you're interested to know the BTS, activated 5.1Rx client version is the culprit as it will get the wrong path (more to do with the manifest file - advanced topic) to the setup client, path as in the where pulse client is installed i.e. C:\Program Files(x86)\Common files\Pulse Secure\Pulse\PulseSecureVersion.ini.
Background: 5.1Rx is a a non-rebranded client version, per my understanding i.e. it will be installed to a Juniper networks folder instead of Pulse Secure. Hence, what was happened is the setup client received a launch command to look for pulse client in a Juniper networks folder, but the 9.1Rx client (as a courtesy of rebranding done in 5.2Rx client above - installed to Pulse Secure folder) would not be there... setup client would be like..uh oh! Pulse client is not installed on this machine and it would try to download the 5.1Rx client (activated version) from the VPN server, now why it's not downloading in your case..coz. you have *disabled installations through the web portal*
Now, why it got fixed after changing the Pulse Client 5.3Rx as default.... you got it! Rebranded client version - right path info - 9.1Rx client found - launched successfully.
Sorry, it's too much information.. hope you got this now. Thanks.
