As a school we are starting student Surface Go devices in September. The intention is to hybrid join through InTune which on a few practice machines has had varying results. We have manged to successfully create an Autopilot configuration, with devices connected to InTune and on-site AD, also moving to the correct organisational unit. The problems seems to be group policies as policies from both Intune and GPO AD are being applied. This is ok for devices on site however when students are off-site all sorts of errors appear as of course the same "onsite" policies are being applied.

Is there something I am missing?? For the last week of so this has caused me much stress as the system seems to function nothing like instructed on the Microsoft help sites.

When any configuration changes are made I have to do a windows reset which takes 10 to 20 minutes!