Windows hybrid-joined devices – system-wide NextDNS deployment and ability to lock the agent

Hi NextDNS team and community,

I’m testing NextDNS on Windows 11 hybrid-joined devices where users sign in using their Microsoft Entra ID (Azure AD) credentials, and I’m looking for the official and supported way to deploy NextDNS system-wide and lock the agent, so it applies to all users on the device.

I’d really appreciate your guidance on the recommended deployment method.