Always On vpn / vpn Start before logon

Sophos is currently going a different direction and working on ZTNA instead. See: https://www.sophos.com/en-us/content/zero-trust-network-access.aspx

ZTNA most likely completely covers your Use case of always on. It works as a SSO client with Azure AD and gives you access to all kinds of Apps specific to the use case. 

Main priorities here are ensuring Microsoft Windows group policy computer/user settings and SCCM updates are processed correctly on roaming desktops.  This doesn't happen unless a desktop is either booted while connected to an internal office network or connected to vpn pre-logon.  ZTNA addresses this?

Actually this is resolved by Azure AD. If you look at the way, microsoft integrated most of those stuff, this is already resolved in the context of Azure AD. 

But ZTNA helps to integrate this even further. 

We're not quite there yet with Azure AD but work is in progress.  Group Policy and SCCM are still internal.