Which feature of Cisco AnyConnect allows pre-login authentication using windows machines, or single sign-on user authentication using Windows logon credentials?

The Secure Layer-2 Network Access feature is implemented through the AnyConnect Network Access Manager (NAM) module, which supports Start Before Logon (SBL) so Windows machine credentials authenticate to the network before the user desktop loads, and it also enables single sign-on by passing Windows logon credentials directly to 802.1X wired and wireless authentication.

Flexible AAA Options refers to AnyConnect's support for various authentication backends such as RADIUS and LDAP, but does not specifically address pre-login or Windows SSO credential mechanisms.

Differentiated Mobile Access refers to per-application VPN and mobile-tailored connectivity features, not pre-login or Windows credential-based single sign-on.

Trusted Network Detection automatically connects or disconnects the VPN tunnel based on whether the endpoint is on a trusted network, and has no role in pre-login or Windows credential-based authentication.