iOS 12 & 13 - alternative authentication methods.

Since we 'upgraded' to the XG firewall from the UTM, we have had an incredible amount of difficulty with iPad user authentication - or more to the point - deauthenticating them!

On the UTM there was a link that would allow users to log out of their session, but this is no longer available.

Is this something that could be implemented to make this all a lot easier?

We tried using the Sophos network agent, and successfully deployed the CA certificate, but whenever I go the the user portal and download the certificate for iOS13, it always results in the 'invalid certificate' message.

I tried following the guide here

https://support.sophos.com/support/s/article/KB-000035996?language=en_US

and the 'sub-guide' here

https://support.sophos.com/support/s/article/KB-000038295?language=en_US

But the issue is we have our domain and MacOS devices set up to use the certificate that is already in place, so we can't replace the certificate with a self-signed one without major disruption.

We really need a viable solution to this as ourr school have invested heavily in the iOS hardware, and they are currently not usable. Could a request be put in to provide a 'log out session' link, like we had for the UTM?

Thanks for any help.