Solution overview

AGAT supports access control for Exchange using client certification

For the sake of that, you need to use Bastion Reverse Proxy and the CAF Filter.

The Bastion should have a configuration for supporting certification on it's HTTPS listener

CAF Filter High-level functionality :

Certificate-Based Authentication (CBA) for Exchange on-premises.
Verify that Outlook can connect to Exchange only if the device has a certificate.

For Windows 10 and Mac

Verify that the device is managed by MDM
Verify the compliance level of Device
Register the device on SphereShield for getting visibility on all devices connecting externally to Exchange
Verify that certificate is issued by root certificate as configured by MDM vendor
Validate certificate values based on regex engine
Configurable mapping of certificate attributes to extract user and device info from certificate
Update last saw time and the last IP used of a device
Write into security auditing all events
Enable validation/inserting data based on specific CN out of the subject/issuer