Hi Matthew you are speaking about an in-place upgrade, so this means every device coming from Windows 11 21H2 to 22H2 with a the more feasible enablement package, won't gain the same protection in terms of Credential Guard? If so, this would make sense to rollout all devices again - what a pain for early adopters, because the new App control feature also does not create a baseline, even not on in-place upgrades.