Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a headache for the administrator who needs to run around allowing exceptions for external devices every time someone loses or forgets a corporate-owned device.
I am trying to understand if allowing users to install the MS365 authenticator app on an untrusted (employee-owned, personal) device is fine (am I also wrong here?), but allowing them to log in and access ms365 from that device is dangerous because it pushes both factors of authentication (user-known password, installed authenticator app/otp) to a completely unmanaged device.
My thinking is that data exfiltration is a breeze here since an attacker just has to pop one of these insecure user devices, monitor and collect authentication material, and begin pumping out the information from that device. I was assured that this type of thing is "handled by Azure's built-in DLP and RBAC which does geolocation, UEBA, etc." and that restricting access to certain devices (eg. a corporate laptop or cellphone) "defeats the purpose of MS365's high accessibility" and is "the old AD way of thinking".
So my question is: as the person in charge of securing this tenant, should I argue that we restrict access to sensitive information (accounting, hr, etc.) only from highly managed (Azure AD joined TPM2.0, STIG hardened, antivirus-agent-running, etc.) endpoints such as I have been taught forever, or am I misguided, and there actually a 0-trust methodology that I'm not seeing or aware of?