chhopkin thanks - and the specific of the questions about a non-domain joined device changing tenant or multiple tenants. To clarify lets say admin applies "setting 1" to true for tenant one, and I login as a user under the scope of that setting and so get "setting 1" to true. But I am also connected to SharePoint/OneDrive in tenant two, and tenant two sets "setting 1" to false. Which one wins? Is the policy service based on the activation user sign in or the storage sign in (becuase they can be different).
And then if I take a BYOD device and move from tenant one to tenant two, and tenant two does not set "setting 1", does it get nulled out or does it remain in place from the previous company I worked for.
Ta
Brian