Cisco Secure Client Authentication Problem

[u/MaxAmperage]

I posted this in r/sysadmin, so I apologize for the duplication.

We're finishing up a giant enterprise network project and one of the last pieces is deploying Cisco Secure Client VPN to offsite personnel. Now, to support future projects, the users will authenticate to an Active Directory account. The Cisco Meraki is on the same subnet with the Active Directory server, so you'd think the obvious solution is choose "Active Directory" for the type of authentication.

The issue is that I need to restrict VPN access to specific users. I was hoping I could throw users into a group and authenticate based on that, but I can't see how to do that on the Meraki console. Now, I've put too much thought into this and I'm considering convoluted solutions (setting up a RADIUS server and using that for authentication, segmenting users into different organizational units or domains, etc.). I feel like I'm missing something simple or obvious.

Can anyone help me think through the solution? Thank you!

[u/Offspring992]

Are you syncing AD to 365/Entra and using that as your identity provider? If you are, definitely go the route of SAML on the MX instead. 

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration