I've just had a client leave his Surface Pro 6 on an aircraft. No MSA set up, just a corporate Microsoft 365 Business account with Azure AD P2.
I was surprised to discover I could not remote lock the device (like I can any mobile), just wipe it. Please add the ability to use "Find my device" and "Remote lock" without needing a MSA. You removed the ability to sync settings on domain joined machines using a MSA, why insist on having one for remote tracking and security!?