Please allow me updating your thread with a current status.
A colleague of yours had opened a call at OSIsoft Technical Support on September 13th. The Technical Support Engineer quickly engaged a mentor from the PI Coresight product escalation team. Technical Support is actively working with you.
PI Coresight had not been tested with Forefront. It appears there exist specific requirements with regards to Kerberos authentication. PI Coresight product escalation supported by developers is about to complete a complex test setup with Forefront that includes a separate Domain Controller on a different network.