Need Help: Connecting FortiGate 200E Wi-Fi with Entra ID for Seamless 802.1X SSO

Hello Everyone,

I am looking for some guidance and best practices for an upcoming internal office Wi-Fi project. 

Our Current Setup:
We are using a FortiGate 200E firewall. Currently, all office users connect to the Wi-Fi seamlessly using MAC address binding. 

Our Goal:
Management wants us to move away from MAC binding and authenticate our Wi-Fi users using our Microsoft Entra ID cloud environment instead. 

Our Main Requirement:
The priority is a completely seamless, invisible user experience. We want to avoid a daily Captive Portal (web pop-up) where users have to manually type their Microsoft credentials every morning. We want an invisible 802.1X / WPA2-Enterprise style connection where they turn on the laptop and it connects automatically.

My Questions:
1. Does the FortiGate 200E natively support a direct 802.1X connection to Microsoft Entra ID without needing an extra RADIUS server in the middle?
2. If a RADIUS server (or a tool like Forti Authenticator) is strictly required to achieve seamless 802.1X with Entra ID, could someone please confirm this for me?
3. What are the best free or low-cost deployment methods/architectures to achieve this setup?

Any advice, documentation links, or setup guides would be highly appreciated. Thank you!