I can see that there might be privacy issues with providing attributes from another tenant, but it would be good if extension attributes set on an Azure “registered” device in the home tenant (which was Azure AD “joined” in another tenant) were honoured in Conditional Access.
Right now the device ID from a registered device can be used in a filter but an extension attribute set on the registered device object cannot.
