Having been involved with a SOE for Linux laptops, you start out hoping you can leverage some of the server Ansible configuration, and you end up running maybe 10% of the configuration in common.

It's also a quick way to find out that Linux still has a ways to go with TPMs and encrypted filesystems (although that's rapidly improving) and Integrity Measurement. The flatpak/snap movement is a bit of a disaster for corporate Linux on laptops, as those still don't have all the features of real executables. For example, Integrity Measurement (the easiest way to meet the requirement for "all programs must be authorised" which still lets developers write programs).