In reply to ATM.

Thank you for stopping by. Yes, this specific use case will stand true if Duo is deployed for AnyConnect client using SAML integration- then the Trusted Endpoint AMP policy will disengage VPNs .If your team is using Radius integration then the policy might not work and will allow access to devices irrespective of the device state. I recommend speaking with your account manager to understand how we can accomplish this for you.