How to access to the BIG-IP with Remote - APM based feature?

Hi, I was curious about this as well. We are in a similar situation where our organization wants AD/MFA to our bigips. LTMs dont support MFA(FRom F5 techsupport(last month)). Our LTMs were never set up with AD, so all user access is local and partition logic was based on random things because there were no standard configuratiins set for usage. Very ad-hoc. So cleanup to go AD is a nightmare. I am heading down the road of AD/MFA at the APM with a webtop that has links to the bigips. We force all users to the new portal(webtop url), they auth/MFA and can see the appropriate webtop to the bigips they are allowed to access, with the current local logins. Its the only thing i can think of because we can't turn on AD AND have local, and do a stepped cleanup. its all or nothing. Right now im battling AD Query failures in the VPE and I know basic AD auth works on the policy, but when i add AD Query, no luck. nothing in the logs is telling m much.