The good news buried in all this: not updating the certificate does NOT stop a device from booting. The impact is security degradation - boot-level protection quietly stops working as intended - not…

Heads up: Microsoft has shipped a tenant-default policy blocking device code + PowerShell/CLI flows since May 2025 for many tenants. Check Conditional Access > Policies for one named…

After remediation: 0 standing findings. Active assignments dropped 118→74, eligible jumped 41→85. That eligible-to-active ratio is a good health metric - a healthy PIM tenant shows far more eligible…