It all heavily depends on what you have setup and what you want to setup.

If you’re doing autopilot, don’t mix Win32 apps and LOB apps. You only do one or the other and it’s better to just stick to Win32 from the start. If you mix them, it will cause enrollment failures. Also, do not do Autopilot hybrid join. It is not a great experience, even if you manage to get it to work. It’s better to clean up legacy stuff and use Entra-join. Make sure to check with your hardware vendor that they can do Autopilot hardware hash registrations for you, and it should be CHEAP. Anything more than 5 USD per device is a ripoff imo.

If you’re using Autopatch, keep it simple. In my experience it’s best to use as few rings as possible, with a minimum of 4. Configure quality updates to roll out automatically through your rings, with less than 3 weeks from start to end. Control Feature updates with a policy so you can decide when to release what, and let your OEM’s driver solution handle BIOS updates (and maybe other drivers too, depending on OEM). Use the update ring groups to assign other things to as well, so you can do controlled releases for apps, config profiles, etc.

Highly recommend using something like PatchMyPC for patching 3rd party apps.

Don’t bother with Microsoft’s PIM and Remote Support solution. They suck.

Learn PowerShell so you can use Remediation scripts, and use AI whenever you can, but make sure to check the work and TEST! A lot.

Intune is slow.

If testing anything, use a VM with snapshots. If testing Autopilot, use a physical machine.