Lenovo Autopatcher ((link)) -

Lenovo Autopatcher: The Definitive Guide to BIOS Password Removal

Lenovo Autopatcher eliminates these risks by synchronizing directly with Lenovo’s servers, pulling only the latest "Critical," "Recommended," and "Optional" updates for your exact fleet. Lenovo Autopatcher

Currently, you cannot run Autopatcher directly in Intune (no WSUS in the cloud). However, you can: Lenovo Autopatcher: The Definitive Guide to BIOS Password