If we have conditional access policies that only allow access to O365 resources from devices enrolled in Intune, are we able to add exceptions to these "Unexpected Country" incidents. If we know that these are coming from the users specific device ID, we shouldn't really need to be flagged since they are coming from Intune Enrolled Devices. If a device is lost/stolen, they will let us know as soon as that happens anyways.