don't give users the options to skip org sign in and register with local admin
intune/Autopilot seem to do a good job of locking down a computer and keeping the user from creating local admin accounts. But this only happens after the user sign in with the organization account. but before the sign in process, the user is given an option to skip the organization sign in and register the device with a local admin account. i understand an admin needing this backdoor but it shouldnt be available to regular users.