An Entra-joined device signs in without a domain controller, but opening a file share is a different transaction. How cloud Kerberos trust exchanges a partial ticket for a full one, what it needs, where line of sight actually matters, and what it will never solve.
The tenant-wide Windows Hello toggle only fires at enrollment, cannot be scoped, and does nothing to devices you already manage. The controlled rollout uses targeted policy, device rings, and an understanding of which settings you genuinely cannot gate per user.
The Conditional Access framework leans on phishing-resistant credentials in every tier. This is the design paper for the credential itself: what Windows Hello for Business actually is, the trust decision most tenants do not need to make, and where it sits in a passkey world.
The two surviving iOS BYOD builds: web-based device enrollment with JIT registration and the Company Portal self-service trap, and account-driven User Enrollment with the service discovery file that kills most first attempts, plus the argument for when each one earns its place.
The Android BYOD build after June 2026: group-scoped enrollment restrictions as the real boundary, the certificate-first Wi-Fi prerequisite, and the one-way Move to Android Management API policy with its verification list, before the CY2026 auto-migration runs it for you.
Running MAM after the design is done: the January 2026 version-floor enforcement, conditional launch as a precedence engine, the two offline timers, selective wipe mechanics, and the Conditional Access grant that actually enforces it.
The Cloud PC PAW build end to end: a deliberately named provisioning policy, the enrollmentProfileName anchor, the PAW-only Conditional Access policy alongside the VCIO CA Framework, and the TAP bootstrap that puts the privileged credential inside the PAW.
The user settings policy behind point-in-time restore: frequency arithmetic, the self-service decision, the most-recently-created-wins targeting trap, and the manual restore point workflow.
