Read the article. Unlike Mozilla's approach, Microsoft's DoH rollout is intentionally designed to not bypass DNS-based filtering. ISPA shouldn't have any problem with what Microsoft is doing.
It sounds like in this early milestone they will NOT fallback to unencrypted DNS to do a sort of 'scream test'.
> We can start seeing the challenges in enforcing the line on preferring resolution failure to unencrypted fallback. In line with principle 4, this DoH use will be enforced so that a server confirmed by Windows to support DoH will not be consulted via classic DNS. If this preference for privacy over functionality causes any disruption in common web scenarios, we’ll find out early.
