Is Credential Guard Included with Microsoft 365 Business Premium

We use Microsoft 365 Business Premium and most of our endpoints have Credential Guard enabled, many by default out of the box. However, we've run into some computers where it will not enable and, in the logs, it indicates it will not enable because the device does not meet the licensing requirements. This happens randomly - we can factory reset the same computer and magically, Credential Guard will be enabled. If we attempt to enable Credential Guard using Intune, we get an error saying that we are not licensed for it.

However, if we are to believe the Windows edition and licensing requirements for Credential Guard, none of the computers in our organization should have Credential Guard enabled (they are all running "Windows 11 for Business", which is what the version changes to once a licensed Business Premium user is associated with the device), yet all but a few have the feature enabled without us intervening.

To really make things confusing, If I go to the Microsoft 365 and Office 365 service descriptions page on Microsoft Learn, under "Available Plans" there is a link to "the Microsoft 365 Business Plan comparison table", the PDF that opens clearly shows that Business Premium includes access to Credential Guard:

Does Microsoft 365 Business Premium include Credential Guard or not? If this entitlement is tied to Windows editions, per my first link, then why is it on and active on most of our devices despite none of them meeting the requirements supposedly outlined on this page?