azure active directory – How to restrict Microsoft Entra ID / Intune enrollment to one device per user?

I am designing a deployment for a client with ~230 users transitioning into Microsoft Entra ID and Microsoft Intune.

The Requirement:

1. Standard Users:Must be strictly limited to enrolling exactly one PC and one Mobile phone.

2. Exception Users:A small subset of users need the ability to register two personal devices.

3. Shared PC Scenario:Some users share a single corporate email identity but log into different physical desktop PCs and separate mobile devices.

Questions:

1. What is the best architectural approach in Intune/Entra to enforce a 1-PC limit for standard users while excluding a specific group of power users?

2. How should we handle the enrollment of the physical PCs used by the “shared email ID” users so they don’t exhaust the individual identity quota?

3. Can this boundary be securely enforced via Conditional Access policies without blocking mobile device enrollment?

Any guidance on policy design or scoping templates would be highly appreciated.