Advisor
ProfessorTo piggyback off of what Stuart is saying here. We do something very similar to his layout. Our devices are in a single static folder that our automation creates/pushes out to. Then we have dynamic folders all using the tenantid (we used to use the staticgroups contains method) to bring them into various rollup folders for reporting/etc. We continue to use dynamic folders as well for client specific requests. For example region based folders. We will create those based on a property, naming scheme, etc.
As a standard we do not run our collectors on client hardware, but in the cases we do, we scope API tokens that are needed to very specific things, but at the same time, there is a point where you just have to accept risk.
