Machine Identity Isolation policies can reject valid credentials unless controllers meet the Server 2025 functional level