I run into similar conundrum. I wanted to check device also got chekced when loggin in. So we do have the option of hostcheck - however, you can also do it via custom certificate request. It might be a bit cumbersome - but it seems to get the job done. Assuming you have a User certificate template (Microsoft internal PKI) - users can enroll certificate via MMC or https://servername/certsrv URL. Once you create the certificate, you can allow accessing roles on realm level.
... View more