The Conditional Access framework leans on phishing-resistant credentials in every tier. This is the design paper for the credential itself: what Windows Hello for Business actually is, the trust decision most tenants do not need to make, and where it sits in a passkey world.
The two surviving iOS BYOD builds: web-based device enrollment with JIT registration and the Company Portal self-service trap, and account-driven User Enrollment with the service discovery file that kills most first attempts, plus the argument for when each one earns its place.
The Android BYOD build after June 2026: group-scoped enrollment restrictions as the real boundary, the certificate-first Wi-Fi prerequisite, and the one-way Move to Android Management API policy with its verification list, before the CY2026 auto-migration runs it for you.
Running MAM after the design is done: the January 2026 version-floor enforcement, conditional launch as a precedence engine, the two offline timers, selective wipe mechanics, and the Conditional Access grant that actually enforces it.
The Cloud PC PAW build end to end: a deliberately named provisioning policy, the enrollmentProfileName anchor, the PAW-only Conditional Access policy alongside the VCIO CA Framework, and the TAP bootstrap that puts the privileged credential inside the PAW.
The user settings policy behind point-in-time restore: frequency arithmetic, the self-service decision, the most-recently-created-wins targeting trap, and the manual restore point workflow.
The ANC build, prerequisites first: subnet headroom, the three service principal permissions, the hybrid join account, and the health check gate that will hold you to all of it.
The build companion to the deployment design article: the provisioning policy wizard in current post-April-2026 navigation, with the naming decision and the change-model traps called out.
