O Only allow user access based on department and/or specific policy configuration (Each department will not be able to access other than their own “exception applies”)
Prevent File Leakage from Corporate Laptop and Mobile Device (All policies have to be non-optional to regular user except Management Level).
Restrict access to corporate Microsoft account from non-corporate device.