@IAMERICAbooted @CynicLib If you can define your boundary at the application level, keeping endpoints out of scope and take advantage of VDI it become

@IAMERICAbooted @CynicLib If you can define your boundary at the application level, keeping endpoints out of scope and take advantage of VDI it becomes a heckuva lot easier.

Or suggest you use a third-party tool outside of your M365 tenant for sensitive data and inherit these protections.