ISE BYODs with TLS, joining Windows Server domains afterwards or before?

Hello guys,

​

a few days ago i asked a similar question at r/sysadmin . Basically i have ISE set up for BYODs with a provisioning app

that configures clients for TLS authentication, ISE beingt the sub CA.

If a BYOD would have already joined a domain before going through the BYOD web configuration the auth fails (domain client does not get the personal cert in his certmanager and only admins can see them on that device (win10))

to make my question less complicated, did anyone manage to set up an ISE BYOD policy with TLS and the ability for those BYODs to join an AD afterwards?

Because apart from joining a domain before being TLS authenticated sounding illogical to me it also does not work,

on the other hand,

joining a domain after a successful TLS authentication did not work for me (the client does not carry the personal cert over from normal win10 account to the certmanager of the AD account, so an AD account would not be able to go further with authentication because he does not get the personal cert in his context )

​

any clues,info is appreciated, also keen to know if anyone does have an ISE with TLS and Domain join setup for BYODs.