Moving from Configuration Manager (still SCCM to many) to cloud-native Intune isn't a switch you flip. It's a sequence of smaller moves, and the order decides how much your users notice. In this deep dive I'll lay out a phased plan: assess what Configuration Manager really does for you, bridge with co-management, move workloads, change how new devices are built and retire the on-premises pieces, with a decision table that maps each capability to its replacement.
How it works#
Two tracks run in parallel, and mixing them up causes most planning mistakes:
- Management is who sends policy, apps and updates. Co-management moves it from Configuration Manager to Intune one workload at a time, on existing devices, without a rebuild.
- Identity is how the device is joined. Cloud-native means Microsoft Entra joined, not joined to on-premises AD. Microsoft states there's no supported way to convert a hybrid joined device to Entra joined without resetting Windows, and because Autopilot Reset doesn't support hybrid joined devices, that means a full wipe.
So the management track can finish on today's hardware, while the identity track follows your refresh and rebuild cycle. Microsoft recommends exactly that: move to Entra join at a natural event such as a hardware refresh, an OS upgrade or a troubleshooting reset. Hybrid join is a bridge, not an end state.
| Device situation | Path |
|---|---|
| New or refreshed hardware | Autopilot, Microsoft Entra joined, Intune only |
| Existing device, mid-life | Co-manage now, reset to Entra join at its next natural event |
| Relies on its AD computer account (machine authentication, computer GPOs) | Stay hybrid joined and co-managed until that dependency is replaced |
| Windows Server, or no internet access | Stay on Configuration Manager |
Step-by-step#
Phase 1: Assess#
- List what Configuration Manager delivers: applications and their deployment types, task sequences, configuration baselines, update groups and automatic deployment rules, client settings and scripts.
- Export your GPOs as XML reports and import them into Devices › Manage devices › Group Policy analytics in the Intune admin center to see which settings have an MDM equivalent.
- Record on-premises dependencies: apps that need Kerberos or NTLM, file shares and drive mappings, printers, AD CS certificates, and Wi-Fi or VPN that uses machine authentication.
- Sort devices by refresh date. That list is your Entra join timetable.
Phase 2: Cloud attach and co-manage#
Enable co-management for a pilot collection. Existing domain-joined clients become hybrid joined and enroll in Intune, while Configuration Manager stays in charge of everything. Add a cloud management gateway if devices spend time off the corporate network. Users notice nothing yet, but you gain Intune remote actions and visibility.
Phase 3: Move workloads#
Build the Intune equivalent first, then move each slider to Pilot Intune and later to Intune. A sensible order is compliance policies, client apps, Office Click-to-Run apps, Windows Update policies, Endpoint Protection and finally device configuration. The details and rollback caveats are in my workload guide. Windows Autopatch needs the Windows Update, device configuration and Office Click-to-Run workloads on Intune.
Phase 4: Change how new devices arrive#
From a fixed date, new and refreshed hardware is provisioned with Windows Autopilot as user-driven, Microsoft Entra joined and Intune-only (see my Autopilot setup guide). If some apps still only exist in Configuration Manager, Autopilot into co-management installs the client during setup as a temporary bridge.
Phase 5: Convert existing devices at natural events#
Protect user data first with OneDrive Known Folder Move. Register existing devices with Autopilot: the deployment profile setting Convert all targeted devices to Autopilot registers targeted devices that are already enrolled in Intune. When a device is due for refresh or rebuild, wipe it and let Autopilot join it to Entra ID.
Phase 6: Retire on-premises dependencies#
Replace each dependency from Phase 1: Windows Hello for Business cloud Kerberos trust for SSO to on-premises file shares, Windows LAPS backed up to Entra ID, and Microsoft Cloud PKI or the certificate connector for certificates. Remove the client from devices that no longer need it with ccmsetup.exe /uninstall, then shrink distribution points, software update points and PXE. Intune manages Windows clients, not Windows Server, so keep Configuration Manager for servers or move them to Azure Arc and Azure Update Manager.
Decision table: what replaces what#
| Configuration Manager capability | Cloud-native replacement | Check before you switch |
|---|---|---|
| Applications and packages | Win32 apps, Microsoft Store apps, Enterprise App Catalog, Microsoft 365 Apps | Repackaging, detection rules and dependencies; this is usually the longest task |
| Software update points and automatic deployment rules | Update rings, feature and quality update policies, or Windows Autopatch | Maintenance windows become deadlines and grace periods; plan third-party patching |
| OS deployment task sequences and PXE | Windows Autopilot | Drivers and firmware from Windows Update; keep imaging only for true edge cases |
| Configuration baselines and GPOs | Settings catalog, custom compliance, Remediations | Settings without an MDM equivalent in Group Policy analytics |
| Endpoint Protection and BitLocker management | Endpoint security policies, Defender for Endpoint, recovery keys in Entra ID | Moving the device configuration workload also moves Endpoint Protection |
| Inventory, CMPivot, Run Scripts, remote control | Intune device inventory, Remediations, device query, Remote Help | Some of these are add-on capabilities, so check your licences |
| Distribution points and peer cache | Delivery Optimization, optionally Microsoft Connected Cache | Bandwidth at sites with many devices |
Verify#
Give each phase an exit check you can measure:
- Phase 2: pilot devices show Co-managed in the Managed by column under Devices › Windows.
- Phase 3: every slider is on Intune, and the workload transition chart under Monitoring › Cloud Attach shows all devices moved.
- Phases 4 and 5: converted devices report Entra join only and no client:
dsregcmd /status | findstr /i "AzureAdJoined DomainJoined"
# Expect AzureAdJoined : YES and DomainJoined : NO
Get-Service -Name CcmExec -ErrorAction SilentlyContinue
# No output means the Configuration Manager client is goneTips & gotchas#
- Never leave a workload with nobody. Assign the Intune policy before moving the slider.
- Start app packaging in Phase 1. Apps are the long pole, and they decide when new devices can skip the Configuration Manager client.
- Pick one authority per setting on hybrid devices. GPO and Intune configuring the same thing is hard to troubleshoot.
- Mixed estates are fine. Entra joined and hybrid joined devices can coexist while the refresh cycle runs, as long as you clean up stale and duplicate device objects.
