Customer environment has WHfB disabled, however when they are running access reports they are seeing a significant number of device joins leveraging WHfB anyway. If these were BYOD devices, where users may have enabled this authentication method themselves, would those credentials then be passed to Azure as a trusted source? I know that once joined to the domain, these user are still being challenged to authenticate for any inside resource access because WHfB is current disabled for the environment. This scenario would explain the reporting, but I want to be sure I'm not missing anything.
