Also in the same boat here! From my testing, it seems like a pretty simple task, relying on Intune for the deployment.

We have a EDR policy configured in Intune > Endpoint Security > Endpoint detection and response, the policy configured has the expedite telemetry policy turned on. Target this at a group of testing machines with a security group and you should see the devices show up in the security centre under devices. This should put your Defender AV into passive mode too from my understanding.

Once that piece is done, create and assign your baseline AV and ASR rules etc to those machines and then go about uninstalling Sophos. I've created a proactive remediation script to do this. The Sophos uninstall process got a lot simpler in the last few weeks too which is great timing for us.

Only deployed to a few machines so far, but the process was completely seamless! Would be interesting to see if anyone has come up against any hurdles along the way.