Policy management with Microsoft Intune

This is a difficult one. You can use MDE and Vulnerability Management to "baseline" your settings against certain industry recommendations (CIS/STIG), but a lot of it comes down to tracking your own configurations, and building your own based on your requirements. Unfortunately, as a lot of CSP settings change different registry keys than traditional GPO, I've seen many pen-test tools fail a device just because they're hard-coded to look at the GPO registry value.