WPA2-Enterprise authenticating against Azure Active Directory

Good afternoon, 

We are getting rid of on premise Active Directory altogether. The only thing we currently use it for is Sophos Wireless.

Users computers are domain joined to Azure AD and file share is Sharepoint. Sophos Wireless is the only remaining tie. They currently have an old SG105 UTM which I want to upgrade to XGS.

Currently they are syncing AD > AAD with AAD Connect. For the UTM, wireless connection is setup as WPA2-Enterprise with Radius pointing to NPS Windows 2016 server and authenticating against AD by group membership.

Does the XGS allow WPA2 (or WPA3 even) Enterprise authentication directly to Azure AD - i.e. Microsoft 365? Don't want Azure AD DS which is the same old school solution that hasn't been updated since 2016 except it is worse.

Let me know.

Thanks,

Alastair