APM: VPN + Azure AD MFA, what license?

I'm not an expert in licensing (and I've spent enough time in presales to not want to be one either ;), but as far as I understand it, any normal SAML connections does NOT take up a CCU (either when using APM as SAML IdP or SP). However, if you then set up a VPN tunnel, or have other objects on your webtop that DO use a CCU (even if you're not using those), it still costs a CCU.

See here for more details: https://support.f5.com/csp/article/K13267

Hope this helps, but I'm sure there's some better license experts around here so I'm happy to be corrected. ;)