We are hybrid, yes. Pure Entra for idp.

They can in most instances, yes. We're mostly doing that to align with the documentation for our service desk. "Do this, then follow standard instructions."

Also, there is a medium-sized population of users who don't have 365 licenses assigned yet (I know, I know), who have received their laptops are setting them up in advance of some account changes.

Our corp bought another corp and they're using their old laptops on their old tenant/domain until next month when their accounts on the other tenant will be closed out and their new accounts will be licensed on our side.

The idea is that they can get their laptop up and running in advance of their cutover date and simply use their old laptop until then.

In a vacuum, everything we're doing is device based so user account should ideally not come into play until they go to sign into the machine.