PKCS Cert or REST ID/ROPC for Cisco ISE & Intune Integration for 802.1x?

On the last milestone to complete our transition from hybrid-joined to Entra ID through Autopilot! In the next few days, we'll be working with our network team to integrate Cisco ISE with Azure AD for 802.1x network access control.

We're exploring two options detailed below. If anyone has gone through this before or is familiar with both options, would really appreciate any advice on whether one is much better than the other in terms of security and user experience. I am now leaning towards option #2 since it seems to require less infrastructure implementation and EAP-TLS should be sufficient. Thank you.

Option 1: PKCS Certificate (Resource Link)

• Integrate ISE and Azure AD by creating an Azure enterprise application and syncing with the secret keys
• Install Intune Certificate Connector
• Create and publish PKCS certificate template on AD CA
• Mirror PKCS certificate template on Cisco ISE and Intune config policy
• Configure Cisco ISE policies

Option 2: (ROCP with REST ID Resource Link)

• Integrate ISE and Azure AD by creating an Azure enterprise application and syncing with the secret keys
• Configure Cisco ISE policies