The old "login as a local admin and fire up VPN" is my favorite but doesn't work for every VPN solution.
I'm interested in the responses myself. Not having done this myself, my initial thoughts are:
- Offline domain join (djoin.exe)
- Azure AD
- Provisioning package via WCD
There are some prerequisites/assumptions here.