Boost security with Microsoft Intune device attestation

Hey Lior_Bela , speaking about Windows devices, to use the isTpmAttested field for the filter, the device needs to be already enrolled in Intune, right?

If so, will this condition be part of the Compliance policies so we can lock any already enrolled device out of the Corp data?

Additionally, is this field only populated when manually running the scan report for the enrolled devices, what's the benefit on adding the filter for the Enrollment Restriction? Or for any new device that tries to enroll the attribute is auto populated?

Thanks!