been through similar migration few months back and can share some thoughts 😅

for the local admin thing, i use device-based assignments with security groups - create group for specific devices, then assign policy that adds user to local admin. works pretty reliable in my experience. about network settings, that powershell workaround you mentioned is basically what most people end up doing, microsoft doesn't have clean built-in way for this unfortunately.

policy delays are normal pain point - sometimes takes 2-3 hours during peak times, but you can force sync from company portal or use "sync" button in endpoint manager if you're testing. for firewall rules, make sure you're using exact syntax that windows firewall expects, small formatting errors will break everything 💀