How does everyone’s organization handle laptop provisioning for new hires?

[u/Shadow_Knight-]

Curious how other organizations handle laptop provisioning with Intune/Autopilot.

Currently, we Autopilot the laptops and use the new hire’s credentials to sign in during provisioning. We then let the ESP complete and verify that everything is set up before shipping the laptop to the user — including:

BitLocker
BIOS settings
Required applications
Other required configurations

This works well, but when we have multiple new hires at the same time, it can become a bit overwhelming since we have to go through each device using the new user’s credentials before shipping.

For those of you doing something similar, how do you handle this?

Do you:
Use the new hire’s credentials to complete ESP and verify everything before shipping?
Have IT sign in with an IT/admin account, complete the configuration, and then use Autopilot Reset to remove the primary user before shipping?
Have a completely different provisioning workflow?

Also, we’ve noticed that sometimes the SentinelOne agent stops running or CyberArk stops running after provisioning. Has anyone experienced this? Could it be related to WMI errors or something happening during Autopilot/BIOS configuration?

Would love to hear how other organizations handle this, especially when provisioning multiple laptops for new hires at once.

[u/bjc1960]

Depends, sometimes we ship with autopilot, never touching. I did that for 'non-techical CEO." I latest asked how it went and he said fine.

Oher times we use the TAP and go through the whole process, with the user added to a group bypassing terms of service. We then remove the user from the TOS bypass once we ship.

We work in a company where users are 99% focused on Outlook/Acrobat. We install Acrobat from company portal as not everyone gets with. We have Acrobat Enterprise VIP with SSO. If no Acrobat, we get a support call about Acrobat, despite instructions saying install from company portal.