The Jamf ADCS is as far I can see a proxy solution that can assign a machine certificate from a company AD CA. Does that mean, that if Mac is in dep and a macbook is outside company network, they can login with AD credentials (through Azure) or do I misunderstand something ?