Check for CA policy that blocks device code flow

[merill]

Device code flow should be blocked by default and only allowed for the specific identities that need it (ideally a specific location too).

[NZLostboy]

Good idea, I don't think this is supported in what-if yet is it?

Additionally do you think we should look only for this specific policy? or would you factor in hybrid joined and compliant device checks as well which can be used to "solve" the same issue?

I think for clarity looking for this specifically makes sense, just throwing it out there as an idea.