Streamlining macOS security: Automatically enable AutoFill after Platform SSO registration

I asked myself the same and came to the following conclusion:

• Run-once: Enabling AutoFill after PSSO registration is a one-shot config change. You don't want it re-running on the Sidecar agent's recurring schedule forever. Packaged as a PKG, you get a receipt (e.g. com.intune.XYZ) plus IgnoreVersionDetection = true, so once the script succeeds the app is marked installed and never fires again. The scripting agent has no equivalent "stop when done" semantic. It's run-once or a fixed recurrence, neither of which fits "keep trying until PSSO is registered, then stop."
• Pre-install gate: The recommended layout uses the script as a pre-install script that waits for an active user session and completed Platform SSO registration, using timeouts while polling to avoid indefinite loops. If the precondition isn't met, the pre-install exits non-zero, the install "fails," and Intune's app-install retry re-attempts it later.
• Delivery channel: Payloadless PKGs go out over the MDM/app channel (InstallApplication) and can be assigned Required, which is generally more deterministic and better-timed around enrollment than the Intune scripting agent's check-in cadence