Our biggest issue is that the Tenant-Wide Windows Hello For Business settings can't be individually blocked by roles or scopes. We have scoped administrators who manage their own Autopilot devices, but we have to block them from the entire Enroll Devices screen to keep them from accidentally turning on Hello For Business at enrollment tenant-wide. As a result, our admins have to save the direct URLs to pages they'd otherwise click through Enroll Devices to get to. Every other function under "Enroll Devices" can have its access limited using intune roles or scopes, but this one exception causes a frustrating experience.