Using 802.1X device authentication on a FortiGate 100D

Hello,

802.1X newbie question:

I want to use 802.1x device authentication on a FortiGate 100D. All Windows 10 clients are directly connected to the 100D hardware switch and no user authentication is required. All clients have valid client certificates. Authentication is done with a Windows Server 2016 NPS.

How do I set this up correctly? All cookbook articles require a FortiAuthenticator or use a Wifi AP.

It looks like i need to use accounting and set up an RSSO group, but i am not sure.

Thanks in advance.

Theo