Curious how folks are managing paid and free apps on Surface Hub? We aren't yet to the point where we can deploy apps using MDM, but when we make an app available in the Windows Store for Business, it becomes available to everyone. Using GPO and AppLocker to keep people out of the private store doesn't seem like a scalable security option, we'd rather be able to control access via security groups. Also wondering how paid apps work. If I purchase a paid app for a device, can it be assigned to a user? What's best practice on "who" it should be assigned to? A departmental user? The Surface Hub resource account? A Surface Hub admin?