MS goes out of their way to make shit harder than it needs to be.
For example. The store, they have a store for business where you can simply whitelist known apps buts it’s a PITA to setup AND they have been threatening to decom it for ages
Want to add safety/security features like secuirty keys. Well if you do it on a non domain joined machine you can just sign into a m365 account to enable a passkey or yuibijey as a second factor.
Want to do that in a business environment. Congrats now you have to deploy a windows CA and issue user certificates to tie to this. Even if you are signing the machine into m365 with ADAL.
They go out of their way to add complexity and failure points.