In addition to what Kita mentioned regarding the terminal service bookmark SSO failing, we have encountered issues with using WSAM (both legacy and Pulse-based).
L3 VPN access is working in our testing
Web-based, core access is working in our testing
Have you had a chance to upgrade your client(s) to see if your use case fails or works successfully?