am I missing something with Set-BrokerEntitlementPolicyRule? I thought excluded users shouldn’t be able to launch sessions?