Autopilot locks Windows OOBE to your Intune instance based on the serial number. The user only has to know their email and a temp password if they're new, or existing login/otp if not. The device can be remotely wiped, and it will start back over at the OOBE (Windows install), ready for the next user.
You can't achieve that with scripts. That requires the ubiquity of Windows as an OS (so device manufacturers play ball). You may find that lock in distasteful, but if that's the world you're already in, it's a magical timesaver.
Have the vendor ship your image?
Or provide your own bootstrap.
Probably something with netboots as well...
If your point is there is a heavy vendor presence, yeah, sure.
But yes, it is all scriptable. Someone has to provision the device, whether that's you or Dell, that's your choice as the customer, not some inherent superiority of one system over another.
That sounds nice, but that's not exactly a feature specific to AD.
All perfectly possible with a couple well placed scripts and some remote logins.
> TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO
Yeah this is the overengineered stuff that is therefore difficult to replicate. Certs and auth predate AD and Azure, the lock-in comes from the overcomplicated SAML style rickety tower of doom that just barely functions...