one practical mitigation you might be able to leverage would be to Rely on the client/VDA prerequisites as a de facto filter. The Entra SSO path only actually engages when the full chain is satisfied — required Workspace app version, required VDA version and Windows build on the session hosts, Entra hybrid/native join state, RDS AAD auth protocol enabled. Sessions to VDAs that don't meet the requirements fall back to standard authentication. That's workable, but you're relying on fallback behavior rather than a hard scope, and the "delayed or failed launches" warning applies exactly to environments where the config is partially complete — so validate the fallback with your actual mixed workloads before broad enablement.