EAP-tls using Fortigate, Fortiauthenticator and Azure AD only no onperm

So i'm pretty new to working with a cloud only environment. So we decided wifi would be eap-tls, so using cert only to authenticate. Does any one have this setup working. Any input would be great. Already have the FAC CA cert...have that template in azure configured. How are you guys having the devices fetch their cert? Scep with FAC? third party ?