SSL VPN - Combining LDAP and Radius authentication

Hey,

I am currently investigating a migration to MFA for the SSL VPN. Currently LDAP authentication is used and for MFA we have set up a radius server that provides MFA (microsoft authenticator). On its own the MFA works perfectly on a test system. Since we cannot migrate all users to MFA simultaneously, the idea is to slowly move end users from ldap to radius auth but i have not been able to get this to work.

If i add Radius to the SSL groups, a user logging in will get the MFA request but gets logged in before he can even accept or deny. I suspect this is due to the fact that fortigate queries all auth servers and takes the first result. Since ldap does not need to wait for the MFA comfirmation, this is always going to be first.

If i remove the end user from the VPN group in AD, then authentication fails before he gets the chance to accept or deny the MFA request. Again I suspect this is due to the fact that LDAP answers first. Authentication to LDAP succeeds, but the list of AD groups does not contain the one requested for VPN and thus authorization fails.

Is there any way to force fortigate to try radius first and if it fails then fallback to LDAP, or to wait for Radius even though LDAP auth succeeds but does not have the required groups?

If not, any suggestions on how to slowly migrate end users to MFA?

Thanks