Currently it appears that when the SCCM agent in the WinPE boot image connects to a Management Point, it selects one without using the Boundary Group rules, instead selecting one from the AD published list, starting with the first alphabetically.
Instead this should behave like the full blown Windows SCCM Client and select a Management Point based on Boundary Groups such as IP range.
It is worth noting that Distribution Points are selected correctly according to Boundary Group by the WinPE client, for OSD content.

Create an OSD variable for Secure Boot called _SMSTSSecureBootState. It should have three values depending on the state and the currently running OS: Enabled, Disabled, NA. This can be used during a TS to determine if Secure Boot should be enabled. Currently, a TS variable has to be defined and set based on if the registry key exists or not.

Add Option to View TS, instead of "edit". Often times I just want to look at a TS for reference, and not edit it. Just safe guarding the TS from my accidental clicks.

We have the possibility to select to "Access content directly from the DP" when deploying a operating System image in a Task Sequence. It would be great to be able to do this for "Run Command Lines" as well.
Example scenario, you want to run a Powershell script from a package before the disk is formatted in a scenario where we use Bitlocker for instance.

Application A and Application B. Application B supersedes Application A. The content is removed off the DPs for Application A.. A task sequence (non-OSD TS) deployment of Application B fails with "The software could not be found on any servers at this time." After reading the logs, it is looking for Application A. BUT a regular application deployment Application B, it works fine, so this issue is ONLY occurring in TS.

Sometimes it might be handy to remove a computer from the OSD collection as a final step during the task sequence. Or additionally add the computer to additional collection(s) for for example extra software deployment or another task sequence.
Now scripts need to be created therefore and in my experience this doesn't always work well.
A predefined step where the collectionname or collectionID needs to be added to add (or remove) the computer to (or from) would be much appreciated.

Provide Mac Provisioning with CM12.

Other vendors provide the ability to image and fully manage the Mac device, when will Configuration Manager provide this feature? Imaging Windows platforms is only part of a corporation desktop landscape, we also support Mac, having a single solution would make logical sense.

When OS Upgrade and Custom task sequences are running offline (such as following a reboot while on VPN) all task sequence manager status messages are discarded. While this is expected in WindowsPE, it would be beneficial for troubleshooting/reporting if OS Upgrade and Custom task sequences would queue status messages locally just like Executive Manager does with software installation status.

It would be convenient to have a method to enter/save your volume licensing credentials to have it directly download an iso from the volume licensing site, extract the wim into a designated storage location, and then import it directly into the console. This would especially be nice considering the more frequent release of new Windows 10 builds. I like running my B&C from the newest image available.

When running a task sequence to deploy a 1703 based image, the second part of the task sequence: "Setup Operating System" does not display.

The screen saying "Just a moment..." is displayed instead of the SCCM task sequence screen, meaning you cannot see the progress.

If the machine is left, it does actually complete the steps, but it would be nice to see the SCCM screen once again!

Give us the option to restrict a required Task Sequence to "When no user is logged on" This would be particularly helpful when using Task Sequences to push out Application updates. That way if the TS tries to run while a user is logged on it won't fail as soon as it hits the applications which are set to "When no user is logged on"

Use the value from the built-in variable SMSTSRebootDelay for reboots that occur during the 'Install Application - Install applications according to dynamic variable list' step. This would reduce the time for OS deployments.

Please add to the Restart Computer OSD task sequence step an option that will check if the system requires a reboot and then only restart the computer if it needs to. Right now to work around this need, we have to execute a PowerShell script and write the results to a custom task sequence variable and then use that variable as a condition on the Restart Computer step. Adding this option natively would be much more elegant. Attached is the script we're using.

At the moment, when you do Offline Image Servicing on a Server WIM - it applies it to all image indexes (Standard, Standard Core, Datacenter, Datacenter Core, etc...)

Can we have an option to select which index (or indexes) we would like to service?

If someone only deploys Standard (gui) and never Datancentre, they don't really need to patch it..

It would also save some time

While a Step for Run Command line can be used for most Windows Installer, if an application uses a EXE it would be nice for the application to be downloaded and the exe used.

at the moment we need to use scripts with passwords in it against a CES/CEP because SMS Agent is in provisioning mode. It would be great to do certificate enrollments during deployment with the certificate enrollment point as the proxy. we use tpm attested certificates to check if the machine is known to increase security

With more and more devices being connected to azure AD, SCCM should have an option to perform a zti deployment and join the newly deployed Windows 10 to azure AD only. not hybrid where GPO needs to exist, but a native support where the connection to SCCM already exist but the computer will not be connected to the onprem domain.

It would be useful to integrate AD authentication in the WinPE boot image for PXE boot OSD.

When deploying operating systems with MDT and WDS, users are prompted to authenticate against AD when PXE booting. However, in SCCM the only supported way to secure the PXE point is with a DP password that all users share.

There are third party "hacks" which can integrate AD authentication in the WinPE boot image (Johan Arwidmark's ADSI drivers) but it seems like this would be simple to implement within the product itself since it is already done in MDT/WDS.