We are in the process of rolling out Okta, including using a second factor for AnyConnect VPN. Works well.
-Pete