with the UK online safety act we're seeing a real spike in VPN usage - the ability to allow VPN usage per-device would be incredibly beneficial eg a users Entra registered BYOD.

Seconded. We have clients who don't care if users use VPNs on their personal mobile devices. Ideally, we wouldn't get alerts for VPN use from mobile devices, but could still use an unapproved rule to automatically lock the user's account if VPN use is detected from any other device.

This would be very beneficial. We've also noticed that it's not uncommon for android users to have a VPN on their phone and not realize it.