I have configured Cisco AnyConnect with Azure AD as a SAML IdP and I want to use the conditional access - device compliance to restrict access to the VPN.

However I have encountered a small problem: Anyconnect uses integrated browser and by default it can't see the system certificates and use them in the device identification. Because of that Azure AD can't see device identifier (identity certificate).  Certificates must be imported into anyconnect manually or by MDM, URI, SCEP. On Android it can be done easily by enabling browser access in a company portal,  however iPhone doesn't have such an option.

Is there a way to share (use different) Azure AD identity certificate with Anyconnect on iPhone? and use it with IdP and conditional access?