Reviews

As I understand it, the E5 is assigned to a user, the device working from can be any computer, as long as the policies allow the user to login to the device and the device is allowed to connect. So I would say no, the owner of the computer is only a matter if you are working on the computer and not in the M365 cloud.

If you are having resistance about it, I think the first step is to engage higher organization levels showing evolved risks. If you get green sign of them next steps are: 1) training teams about security and risks; 2) review organization's security policy;   2.1) maybe create a standard about IAM's administration; 3) implement IAM policy There is no formula about which team should do what, each organizations has its own way of working. It isn't a question of organizational chart, it's a question of resposibility. The most important thing is to ensure teams are aware of the their roles in the security implications.