MicrosoftGreat write up! The Secure Boot Trust train is going to be coming soon, and this is great direction. I have spent countless hours on this, and it can be a lot, but this was very helpful. And well written.
I wanted to share two links one from the CSP Portal depicting all the Org Secure hypotheticals, to which some apply to SBT while others not as much but nonetheless tons of good data:
https://learn.microsoft.com/en-us/intune/device-security/identity-protection/configure-tenant-wide-policy?source=recommendations
Second is from the Devs who work on UEFI. They have been working on a couple Python Scripts that really can do almost anything from an Org Wide granular understanding of exactly who is who and what is what which I thought was really interesting and wanted to share:
https://www.tianocore.org/getting-started.html
Cheers,
