My apologies. I felt a little like you were agreeing with the previous commenter ("no nefarious software") when you were talking about Autopilot, and I thought it worth pointing out that your employer certainly can install "nefarious" things even if they didn't directly provision the device for you.
Of course I know that a lot of work still goes into setting up Intune so that your Autopilot devices are fit for use!
I haven't been able to find a way of viewing where filters work at all. Are they broken, or do they only work in specific circumstances?