1) Kernel-level DRM for multiplayer games (looking at you, Marathon)
2) Intentionally nerfed MSO 365 apps on web and macOS
You could make a strong case that MDM (which InTune uses as well) negates the AD + GPO advantages of the past 20+ years in enterprise.