...
When a user signs into their app, SphereShield requests the relevant service (such as O365 / Teams) send the client to authenticate through ADFS. ADFS is publihsed by Bastion with the CAF filter and allows SphereShield to request a client certificate from the device and only allows the user to proceed with signing in if the certificate matches specified criteria.
...