Enable compound claims on devices in scope for an authentication policy