An administrator is setting up Cisco AnyConnect on a Cisco ASA with the requirement that AnyConnect automatically establishes a VPN when a company-owned laptop is connected to the internet outside of

Start Before Login (SBL) connects VPN before the Windows login screen but does not perform any network location detection - it does not automatically connect or disconnect based on whether the device is inside or outside the corporate network.

TND continuously monitors the network environment and automatically triggers an AnyConnect VPN connection when the trusted network is no longer detected, and disconnects it when the trusted network is rejoined. Machine certificate authentication is correct for company-owned devices because it authenticates the device itself rather than a user, allowing the VPN to establish automatically and silently without requiring any credential prompt.

SBL with machine certificate authenticates the device correctly but SBL is designed for pre-login domain authentication scenarios, not automatic network-location-triggered VPN establishment.

TND is the correct detection feature, but user certificate authentication is tied to a specific user identity rather than the device, and cannot support fully automated headless connection without a user session.