Has Anyone Successfully setup MFA on their SSL VPN using a third party that can send push notifications instead of appending a password?

We are in the stages of rolling out MFA on every connection possible with our clients, and the last step is the Sophos SSL VPN we use in conjunction with our XG firewalls and our identity provider OKTA. We have been looking to implement this for some time now, and there has been constant bumps and failures along the way, and it doesn't appear there is any real clear documentation on this process or setup.

I'm wondering if anyone out there has completed this project using a third party identity provider (OKTA, etc) to allow for push approvals for VPN connections with XG firewalls.

Thanks for any/all help!

-Larry