Under the advance settings of Remote Access IPsec there is an option to enable the "Connect tunnel automatically" - Select to automatically turn on the connection when users sign in to their endpoint devices.
You can look into ZTNA, as it does this kind of approach naturally. ZTNA is included in the Endpoint (but not needed to have the Sophos Endpoint) starts with the Windows Login and builds the tunnel everytime.
Quote