We use 365/Azure for most things. I'm trying to meet 3.5.2 to uniquely ID and authenticate user devices - it seems like I need entra to manage devices that granularly, but I'm trying to save on costs - how does the plan work? Can I enroll only a portion of employees, those that handle CUI, and not everybody?