Pushing a Configuration Profile during Forticlient install

OK to set the scene.

We are using Fortinet EMS Cloud with Entra SSO authentication.  We create the deployment and push via Intune.  Our machines are built with Autopilot in a Hybrid setup.  When the Forticlient is installed and the machine rebooted, the VPN shield is not present so the user in unable to connect to the network remotely.  Note, this is not an issue for newly built machines on the network only those that are remote.

The endpoint profile is not pushed to the machine until the user has logged into the machine.  But as the user cannot login, the machine cannot receive the profile.

How can the configuration profile be pushed as part of the initial Forticlient install?

Martin