And you didn’t even go into the network side of things, where Microsoft nearly forces you whitelist everything on the firewall, since they change like weekly, which IPs or URLs they want whitelisted, sometimes even going through third-party datacenters. And of course their documentation only gets irregular updates and can’t be easily parsed.