Yeah, thanks, I had come across that one. Assuming this will cover devices that are either locked or not logged in....would it cover being able to remote to a device that is logged in but we don't have a user to accept the connection? Thinking along the lines of public facing devices, kiosks etc etc.

Our default for Corporate devices would be for the user to have to accept the connection for obvious security reasons, but we would want to ring fence certain devices to not needing acceptance.

Does this mean that the fourth option here is kind of redundant at the moment within the Intune RBAC?