Why our users are getting local admin access on devices when the device runs through Autopilot profi

999 of the 1000 times its just that those devices didn't got the Autopilot profile 🙂
Can you confirm if those newly wiped enrolled devices do have applied the device name template?

Besides that autopilot profile, its always a smart thing to do to have a backup solution in place for when the user would still be admin..
https://call4cloud.nl/2021/04/dude-wheres-my-admin/ (which also has a link to this one)
https://call4cloud.nl/2020/03/remove-all-local-admins/

But again... first make sure they did receive the profile 🙂