This kind of thing is seen as a positive in the infosec space, is it not? Meaning that an end user can't come along and boot linux (or anything else) via USB and bypass system security controls.
I'm personally not a fan and won't buy anything locked up in such a way, but I'm pretty sure that the security team is. Regardless, we see this all the time in other devices - tablets, phones, routers, gaming consoles, etc. It's only logical that MS would want to pursue lock-in in their subsidized environments as well.
If your disk is encrypted, no one's getting in there. The most they could do is wipe your machine clean and use it as their own, and I think that's still possible with this model of laptop.
I'm personally not a fan and won't buy anything locked up in such a way, but I'm pretty sure that the security team is. Regardless, we see this all the time in other devices - tablets, phones, routers, gaming consoles, etc. It's only logical that MS would want to pursue lock-in in their subsidized environments as well.