How are you securing ActiveSync access to Exchange on-prem

Looks like I'm going back to the drawing board for APM and ActiveSync.  I have forever user a user-cert check, issued by an MDM system to assure the user and device are trusted, before authentication.    This method will not work with Outlook for iOS, at least no that I've seen.  Also, we'll be looking at Online mailboxes soon.  How are others securing ActiveSync?    Have you found that APM just doesn't work well for this going forward?