AutopilotNuke

Runs from OOBE screen, connects to Azure AD, Intune and optionally to AD DS, finds all objects for the serial number of the machine it is running on, then deletes it from everywhere, then adds it to Autopilot again.
Asks for deletion of each object
Usage:
- The script can work from running Windows 10, but be careful removing native Azure AD joined Intune Devices - you can lock yourself out, if you do not know local administrator's password
- Intended usage – from OOBE (Out of Box Experience)
- While in OOBE, hits Shift+F10
- Powershell.exe
- Install-Script AutopilotNuke
- Accept all prompts
- & 'C:\Program Files\WindowsPowerShell\Scripts\AutopilotNuke.ps1'
- The script will:
    Download and install all required modules (accept all prompts)
    Show you the Serial Number of the machine
    Prompt to connect you to Azure AD and Intune Graph
    Ask you if you want to connect to local AD (ADDS, NT Domain) so it could delete old records from there. Enter the local FQDN (domain.com, contoso.local) of your AD Domain
    If you entered local AD domain, it will ask you for the username and password, for the username, use <NetbiosName>\User format
    Search in Autopilot for the serial number
    Show you all objects in Intune and AAD related to that Serial Number
    Ask if you want to delete in from Intune then deletes
    Ask if you want to delete in from Autopilot then deletes
    Loop through all AAD and AD (if it was selected) objects and ask to delete them
    Ask if you want to add it to AP then adds

Minimum security rights needed:
• To authorize Intune Graph, you will need global admin, but this is just one time. Ask your GA to run:
   Install-PackageProvider -Name NuGet
   Install-Module AzureAD
Install-Module WindowsAutopilotIntune
Install-Module Microsoft.Graph.Intune
Connect-AzureAD
Connect-MSGraph
Accept the consent prompt
• Custom role with the following permissions required in Intune:
Managed devices
    Read
    Delete
    Update
    Enrollment programs
    Create device
    Delete device
    Read device
    Sync device
Assigned to All Devices (did not try scoping it with RBAC, but should work in theory)
• Cloud device administrator role required in Azure AD
• AD DS rights similar to Intune Connector rights: https://docs.microsoft.com/en-us/mem/autopilot/windows-autopilot-hybrid#:~:text=The%20Intune%20Connector%20for%20your,the%20rights%20to%20create%20computers.