Well... f-me I guess. I just spent an entire day setting up my work VM. After manually adding serial numbers and device ID's and whatnot into the XML, by way of <smbios mode = sysinfo> and I was finally able to extract a CSV that our IT department was able to import into Entra. And it worked! All except Secure Boot, so I had to manually install the company portal app. This is now telling me I have a couple of days to whip my PC into shape, or the access is revoked.
You're saying secure boot is feasible by just passing through the TPM?