Tag not monitored by Microsoft.
While valid, this is not necessary. Assuming you will use ConfigMgr issued tokens or the devices have an Azure identity (because they are either hybrid Azure AD or Azure AD joined), then you can enable enhanced HTTP on your existing MP: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/enhanced-http