You might be able to use something like distrobox instead of a full VM. That would at least put it in a container that you could either run from an encrypted partition or something.
Different users would be the “simple” way you’d normally do something like this under Linux. But if your regular users have sudo access, you can’t really lock anything down.










Two reasons:
The feature likely won’t work as well as you might think. What happens when you leave for 10 minutes to get some lunch, and that’s when your boss’s boss checks your location and it says you’re working from home or something. And now you get written up because you’re supposed to be in the office three days per week. I get this is a specific and convoluted example, but stuff like this happens–a feature is released, and management is too stubborn to take things with a grain of salt (or they otherwise won’t consider the limitations).
You’re assuming they’re only using your location data to update your in/out status. Neither MS nor your employer will ever be content to only use limited information when they have access to more. And while it would be somewhat limited if it were only on work devices, understand that a lot of employers expect people to install this shit on their personal devices (I was the only holdout in my department who wouldn’t/couldn’t install MS authenticator on my phone, it was a whole thing).