Sorry in advance for a long post. Just need some other actual sysadmins to discuss things with.

We're piloting moving away from Omnissa (formerly VMWare) Horizon for a variety of reasons. Currently, over half of our users are on it exclusively. This has brought up a lot of things for us to consider. We're an all Windows / Active Directory / O365 company. I can fully change anything with our processes and how things are done as part of this project, so I want to make sure things are well thought out and done right.

For reference (skip to the questions below if you want, this is just to make the questions make sense):

• We're talking about 400 or so people (at 30 sites) migrating from Horizon in our data center to local machines. We're currently running a Hybrid AD/Exchange Online environment. Almost all users have Office 365 E3 licenses (not M365). In Horizon, they all have an H: drive mapped via their AD profile, and use folder redirection to store all of their user directories to that drive. Current users who don't use Horizon have the H: drive as well, but don't use folder redirection currently, so where their data is is hit or miss whether it is properly stored on the network - we're hoping to change that as part of this project.
• Management of our current systems is easy with Horizon. When we want to update software, we update the App Volume and they have it the next time they log in. We update the browsers/Office/OS as part of a monthly golden image update. We can shadow the user sessions through Horizon, or by shadowing the thin client (Wyse terminals, many of which need to be replaced). When we need a completely new Golden Image, we can quickly deploy one using Microsoft Deployment Toolkit.
• Management of the current desktops/laptops is more of a mess, as they are a bit of an afterthought. We currently have access to Connectwise Automate through an MSP that we use in what would best be called a hybrid manner. We use them for our ticketing system (though we handle most of the tickets in-house), and for some limited access to Automate - they handle patch management for us, and we can use ScreenConnect for remote control, and other back end system visibility and control. However, we don't have the ability to push software or use other automation features. We also use Crowdstrike for endpoint security and Arctic Wolf for MDR, and Cisco Duo for MFA. For pushing software, we have a PDQ Deploy/Inventory setup we did a demo for and have continued to use on the free tier while we decide our next move.

What we're hoping to do:

• Buy desktops/laptops for all of the users currently on Horizon. Figure out a way to easily manage (remote control, patch, install/update software, deploy) a lot more PCs than we had been. See what else we can replace from our software, and how to implement some better practices across the board.

Questions:

1. Having only O365 licenses, we haven't had access to Intune. Looking into it, it seems like we should be able to use it to do most of what we need to do on the end points? Deploy new or reimage PCs with Autopilot, deploy apps with Configuration Manager, remote control systems (including elevation, full control, and unattended) with Remote Help. Does that all sound correct, or is there anything that I should avoid? Is it excessively complicated or otherwise bad/annoying, and a third party solution would be better? We're hoping to replace Connectwise Automate at the very least.
2. What is the best way to handle profile management? The options seem to be some combo of roaming profiles (old school!), folder redirection, and OneDrive. It's easy to have folder redirection via GPO with Horizon, since their network drive is at the same datacenter and has a 25Gb network connection from their Horizon machines to the server. Our users are scattered at 30 different sites, many of which are quite rural and don't always have the best connections (especially upstream), so we'll have to change that. However, we of course don't want all of their data to only live on their PC. Would the best long term solution be something around OneDrive KFM, vs. one of the other solutions and maybe offline files? If we could get the Horizon redirected folders AND all the current non-VDI users consistent in one swoop that would be a huge win. One caveat is that we have a lot of PST files out there still, so it may involve us speeding up the upload of those into their Exchange archives first.
3. Does anyone have experience moving from Crowdstrike to MS Defender for purely endpoint security? I personally like Crowdstrike, but I wonder if the Defender & Arctic Wolf combo would be comparable? In my experience, anything MS is scattered and more difficult to manage, so I'm hesitant to do this.
4. Because of the rural nature of our customers, and iffy internet service for our end users, we have a few people who really want to stick with Horizon as their VPN barely works. Maybe a few Azure VDI desktops for those users? Any other thoughts for a good solution for them?
5. Is all of this doable on M365 E3 licenses? My boss is wondering if we can just have the admins deploying computers on M365 E3, but I'm pretty sure that's not the case. We have a meeting with an "MS licensing expert" next week so this question isn't critical.