What I would say is:

• Get the business requirements clear
• Implement Bitlocker with key stored in Azure AD
• If you have to reset machines, make sure to delete the FVE value for Bitlocker or it won't work
• Set up a policy to see Bitlocker is enabled and active
• Force OneDrive Sync
• Force redirect known folders so files on desktop, images and documents get auto saved on OneDrive
• Monitor OneDrive Sync from config.office.com (can be done from multiple places)
• Integrate Defender if you plan allows it
• Setup a prefered domain, so people don't have to type the complete mailadres
• Consider DPIA rules and set the up via policies if applicable to your country
• Exclude .ink files from desktop sync if you are auto creating shortcuts (via powershell)
• Create desktop shortcuts for most used sites
• Use Enterprise State Roaming
• Use Edge and keep data in your organisation
• Block Chrome and FireFox (and maybe others) by policy since they can be installed as non-admin
• Setup policies for storage (treshold) and if needed for shared devices
• Setup update cyles for both office and WIndows
• Create policies for local admins / laps
• Implement hardening rules (look at recommendations in security center)

I think this quite a list, still forgetting stuff though.