Currently, we have some legacy equipment that we allow to bypass conditional access as long as it is from within our network, and we will apply those exceptions to those policies. They are extremely limited in scope, and would make the client compliant in my opinion. We should be able to mark some of these controls as risk accepted, in progress, or complete with an asterisk, instead of it just auto-detecting based on the policy.
