I run into similar conundrum.  I wanted to check device also got chekced when loggin in.  So we do have the option of hostcheck - however, you can also do it via custom certificate request.    It might be a bit cumbersome - but it seems to get the job done.    Assuming you have a User certificate template (Microsoft internal PKI) - users can enroll certificate via MMC or https://servername/certsrv URL.   Once you create the certificate, you can allow accessing roles on realm level.    ... View more

I did the client cert and added custom expression that checks the certAttr.altName.UP = xxxx That way I was able to specify devices that can access the role. For example, if the login user is member of allowed mobile users and UPN is IPAD458, then map the role ... group.AllowedMobileUsers AND (certAttr.altName.UPN = 'IPAD123' OR certAttr.altName.UPN = 'IPAD234' OR ... View more