We run an explicit whitelist, enforced through Microsoft Entra (or was it Intune).