AMA: Enrolling modern devices with Windows Autopilot

The feature was designed with a CMG in mind as a general core assumption of Autopilot is that connectivity to the on-prem environment may or may not exist. Ultimately, as long as the ConfigMgr client can communicate with the site, there's no reason it shouldn't work. Providing that connectivity would be tricky during Autopilot though (I can't actually think of a way to make it happen) as there is no VPN client deployed or connected at this point in Autopilot and IBCM wouldn't be sufficient either as the device hasn't had a client auth cert deployed to it yet.