Windows Office Hours: May 16, 2024

Same answers here ultimately. By design and working as expected. As noted, you 100% should also be using Conditional Access to gate access from personal devices and should be blocking Intune enrollment on personal devices. Once you do that, I don't see or know of any challenges here although we're open to feedback on this. Note that the initial user "login" isn't a full login at all, it's mainly providing credentials to Entra to authorize the activity and prepare the device locally for the end user. Once AP and OOBE are finished, then the user must login. No, we cannot persist credentials between these two steps (from memory, we actually used to but this was weak from a security perspective).