We value your privacy

We use cookies to analyze site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Microsoft Intune
  3. Configuration Manager to Intune
Configuration Manager to Intune migration

You do not have to switch anything to start getting value from Intune.

Both management authorities can run on the same Windows machine simultaneously. The documentation is explicit that moving a workload is optional, and that simply enrolling your existing clients gives you Conditional Access with device compliance, remote actions and Autopilot provisioning straight away. Workloads move afterward, individually, each one piloted first. Understand it that way and a migration that has been eighteen months out for the last five years becomes a sequence that actually reaches an end.

Book a migration reviewSee the seven workloads
Configuration Manager to Intune migration for US organizations
  • Seven workloadsMoved individually, when you are ready
  • Zero requiredImmediate value without switching any
  • Pilot firstTest each workload on a subset of devices
  • Both at onceConfigMgr keeps everything you do not move
The framing that unblocks these projects

This is not a migration with a cutover date.

Ask why so many Configuration Manager estates have sat unmigrated for half a decade and the answer is always the same: everybody pictures one enormous move. What was actually designed is the precise opposite of that.

  • Enrolling the clients you already have delivers capability on day one without touching a workload. Conditional Access backed by compliance, remote actions including restart, remote control and factory reset, centralized health visibility, modern provisioning. For a lot of organizations that list alone justifies the first phase without any further argument.
  • After that, each of the seven moves on whatever schedule suits you, and everything left behind carries on being managed exactly as before. There is no moment where you must commit to the whole program, and no moment where the old platform stops working because the new one started.
  • Any workload can be piloted against a separate collection before a larger group sees it. So every step gets tested on people who will actually tell you when something broke, and every step is reversible in practice rather than merely in the design document.
  • Put those together and this becomes a run of contained changes spread across quarters, slotted around whatever else your team is committed to. Not a project requiring a window, a change freeze, and a rollback plan that nobody in the room genuinely believes would work.
Ask us to sequence the workloads for your estate
How it works

Eight things about the migration that change how the project should run.

The published framing is concurrent management of Windows devices by both platforms at once, letting you cloud-attach the investment you already made while retaining the freedom to use whichever technology genuinely suits each individual workload. Read that carefully, because it is a far less committal proposition than the word migration suggests.

You get value before moving a single workload

Enroll your existing clients and a list of capabilities arrives immediately: Conditional Access backed by device compliance, remote actions covering restart, remote control and factory reset, centralized visibility of device health, users and devices and applications linked through the directory, and modern provisioning. Not one item on that list requires you to switch a single workload authority first.

Seven workloads, moved individually

The set covers compliance, Windows Update, resource access, endpoint protection, device configuration, Office Click-to-Run applications and general client applications. You are under no obligation to switch any of them, and you may move them one at a time whenever you are ready. Whatever stays behind carries on being managed exactly as it is today, alongside everything co-management does not touch at all.

Pilot each workload on a subset before committing

Each workload can be piloted against a separate collection, so the new functionality gets exercised on a manageable subset well before a larger population sees it. That capability, available per workload rather than once for the project, is what converts this into a series of reversible steps instead of one high-stakes cutover. It is also why these engagements can proceed without imposing a change freeze on anybody.

Two paths in, depending on where the device came from

Existing clients take one route: establish hybrid identity, then enroll them. Brand new internet-connected machines take the other: they join the directory, enroll automatically, and you add the Configuration Manager client afterward to reach the same co-managed state. Nearly every organization ends up running both paths at once, which is perfectly fine and considerably smoother when it was planned rather than discovered.

This is not the same as hybrid join, and Microsoft says so

The documentation addresses this head on: one is a management option, the other an identity option, and customers conflate them constantly. The two interact, certainly, but they are not the same decision and cannot be settled together. Establishing which of the two questions somebody is actually asking tends to clear up half the confusion inside the first workshop.

The device identity requirement, which excludes one common state

Machines have to be genuinely connected to the directory, meaning either hybrid joined or fully joined. Anything merely registered, the state often called workplace joined, is explicitly unsupported here. Go and find that population now. Discovering it during your first pilot, with an audience watching, is a considerably less pleasant way to learn the same fact.

It does not solve remote Configuration Manager clients

The guidance is unambiguous that this is not, by itself, an answer for remotely connected Windows machines, because the client still has to reach its assigned site whatever else is true. A cloud management gateway is what addresses that. Note also that neither requires the other: you can have a gateway without co-management and co-management without a gateway, though they do complement each other well.

Co-management, not coexistence, and the difference matters

A distinction is drawn between the two. Running Configuration Manager alongside a third-party mobile device management service is coexistence, not co-management, and the difference is functional rather than semantic: the two Microsoft platforms balance workloads between themselves to avoid conflicts, and third-party services do not participate in that. So coexistence carries real limitations. Anybody with a non-Microsoft platform in the mix should understand that constraint before anything else.

How we approach it

Four things that turn a stalled migration into a sequence that finishes.

Nearly every estate we get called into has been roughly three years away from migrating for the past five. Nothing technical is holding it up. What is holding it up is how the whole thing has been framed inside the organization.

We take the immediate value first and prove the model

Simply enrolling your existing clients produces Conditional Access with compliance, remote actions, centralized health visibility and modern provisioning, with no workload switched. Delivering that before anything else does three jobs at once: it demonstrates the approach is safe, it gives the business something they can see, and it earns the credibility that the harder workload moves will need later.

We find the unsupported device states before the pilot

Machines that are merely registered rather than properly joined cannot participate, and every estate we have examined contains some. Find them beforehand and you have a known remediation task with a number attached. Find them during the pilot and you have a confusing failure in front of stakeholders. It takes a query, not an investigation.

We sequence workloads by benefit rather than by list order

Compliance goes first as a rule, since Conditional Access is waiting to consume the output. Windows Update follows, because it unlocks Autopatch. Device configuration and client applications come much later, carrying as they do the deepest existing investment and the heaviest packaging burden. The published list is a list, not a running order, and treating it as one is precisely why so many of these projects stall on the difficult workload three weeks in.

We answer the remote device question honestly

The documentation says outright that this does not by itself solve remotely connected Windows machines, because the client still has to reach its assigned site. So if a substantial slice of your estate almost never touches the corporate network, you are looking at either a gateway conversation or a case for moving the affected workloads earlier than planned. Either way we raise it in week one rather than month four.

Where this matters most

Six situations where the migration is the right next step.

Three things link all six: a Configuration Manager estate that genuinely works, a real reason to modernize something, and absolutely no appetite for a migration with a cutover weekend attached to it.

An estate that works, run by people who like it

The platform does its job, the people running it know it intimately, and nothing is on fire. This is exactly the situation co-management suits, because it adds cloud capability without asking anybody to walk away from something that works, and because workloads then move when the team is genuinely ready rather than when a Gantt chart says they should be.

An organization that needs Conditional Access on Windows devices

This is the trigger we see most often, and it usually arrives from outside, through an insurance questionnaire or a customer security review. Somebody now requires that only compliant machines reach company resources, and Configuration Manager on its own simply cannot feed device compliance into Conditional Access. Enrolling your existing clients supplies exactly that, immediately, before a single workload has moved.

A workforce that stopped coming to the office

Clients have to reach their assigned site, and with a hybrid workforce a great many of them now rarely do. Your options are a gateway or accelerating the update and configuration workloads. What distinguishes this scenario from the others is urgency: here the existing arrangement is not simply dated, it is getting measurably worse every quarter as attendance patterns settle.

A regulated firm needing modern device evidence

When compliance state, device health and patch currency all have to be demonstrated to a SOC 2 auditor, an examiner or an insurer, centralized health visibility with cloud compliance reporting produces a far cleaner answer than a Configuration Manager report the reviewer has never encountered before. Moving compliance first is what relocates that evidence to where the people asking actually expect to find it.

An organization buying new devices and wanting Autopilot

Modern provisioning appears among the immediate benefits, available before any workload moves. If your team is still imaging machines, being able to have a laptop shipped straight from the supplier to somebody home address and configure itself on first boot is usually the single change that carries the business case for the entire program, with no further persuasion required.

A group with more than one Configuration Manager environment

Several instances, usually inherited through acquisitions or left over from regional splits made a decade ago. Since multiple instances can connect to one cloud tenant, you can establish a single consistent management plane across all of them long before anybody takes on the far larger job of consolidating the on-premises environments themselves.

Three positions

Where organizations with Configuration Manager currently are.

Plenty of organizations sit in the right hand column, and almost none of them chose to. It is simply where you end up when a migration is conceived as one large move, and no quarter ever turns out to have room for one large move.
Conditional Access with device compliance
Co-managed and progressingYes
Co-management enabled, nothing movedYes
Configuration Manager onlyNo
Intune remote actions available
Co-managed and progressingYes
Co-management enabled, nothing movedYes
Configuration Manager onlyNo
Autopilot provisioning available
Co-managed and progressingYes
Co-management enabled, nothing movedYes
Configuration Manager onlyNo
Centralized device health visibility
Co-managed and progressingYes
Co-management enabled, nothing movedYes
Configuration Manager onlyPartly
Update management modernized
Co-managed and progressingYes
Co-management enabled, nothing movedNo
Configuration Manager onlyNo
Path to Windows Autopatch open
Co-managed and progressingYes
Co-management enabled, nothing movedNo
Configuration Manager onlyNo
Configuration delivered without site connectivity
Co-managed and progressingYes
Co-management enabled, nothing movedNo
Configuration Manager onlyNo
Dependency on on-premises infrastructure reducing
Co-managed and progressingYes
Co-management enabled, nothing movedNo
Configuration Manager onlyNo
Remote devices manageable without a gateway
Co-managed and progressingIncreasingly
Co-management enabled, nothing movedNo
Configuration Manager onlyNo
How common this is
Co-managed and progressingUncommon
Co-management enabled, nothing movedCommon
Configuration Manager onlyCommon
Feature
Co-managed and progressing
Co-management enabled, nothing moved
Configuration Manager only
Conditional Access with device compliance
YesYesNo
Intune remote actions available
YesYesNo
Autopilot provisioning available
YesYesNo
Centralized device health visibility
YesYesPartly
Update management modernized
YesNoNo
Path to Windows Autopatch open
YesNoNo
Configuration delivered without site connectivity
YesNoNo
Dependency on on-premises infrastructure reducing
YesNoNo
Remote devices manageable without a gateway
IncreasinglyNoNo
How common this is
UncommonCommonCommon
The seven workloads

What each one moves, and where we usually start.

The workloads themselves come from the published list. The order they appear in is our own, drawn from which moves have returned the most benefit for the least upheaval across the estates we have actually worked in.

Workload

Compliance policies

What moving it changes
Device compliance evaluated by Intune, which is what Conditional Access consumes. Usually first.

Workload

Windows Update policies

What moving it changes
Update management moves to Intune, and opens the door to Windows Autopatch.

Workload

Endpoint Protection

What moving it changes
Defender policy managed from Intune rather than Configuration Manager.

Workload

Device configuration

What moving it changes
Settings and configuration profiles. The largest workload and usually the last of the core ones.

Workload

Resource access policies

What moving it changes
Certificate, Wi-Fi, VPN and email profiles delivered from Intune.

Workload

Office Click-to-Run apps

What moving it changes
Microsoft 365 Apps deployment and update management moves.

Workload

Client apps

What moving it changes
Application deployment. Frequently the one with the most packaging work behind it.

Workload

Everything else

What moving it changes
Stays with Configuration Manager, including features co-management does not cover.
WorkloadWhat moving it changes
Compliance policiesDevice compliance evaluated by Intune, which is what Conditional Access consumes. Usually first.
Windows Update policiesUpdate management moves to Intune, and opens the door to Windows Autopatch.
Endpoint ProtectionDefender policy managed from Intune rather than Configuration Manager.
Device configurationSettings and configuration profiles. The largest workload and usually the last of the core ones.
Resource access policiesCertificate, Wi-Fi, VPN and email profiles delivered from Intune.
Office Click-to-Run appsMicrosoft 365 Apps deployment and update management moves.
Client appsApplication deployment. Frequently the one with the most packaging work behind it.
Everything elseStays with Configuration Manager, including features co-management does not cover.
How an engagement runs

Five steps, spread over quarters rather than weeks.

Expect four to eight weeks for the opening phase, delivered remotely. Everything after that proceeds at whatever pace your team and your change process can genuinely sustain, which is rather the whole point of approaching it this way.
  1. 1

    Assess prerequisites and device state

    We check the Configuration Manager version, the directory licensing, whether automatic enrollment is switched on, and above all the device identity position, since merely registered machines cannot participate and finding them is the first thing that has to happen. We also establish whether devices reliably reach their assigned site, because that answer settles the gateway question one way or the other.

  2. 2

    Enable co-management and take the immediate value

    Existing clients get enrolled with nothing switched, which delivers Conditional Access with compliance, remote actions, centralized health visibility and modern provisioning. The purpose of this phase is twofold: it proves the approach is safe, and it puts something visible in front of the business before anybody is asked to move a single workload.

  3. 3

    Pilot the first workload

    Compliance in most cases, run against a separate collection so the new behavior is exercised on a small population before anybody larger is switched. Note that piloting here is a designed capability rather than something we improvise, and using it as intended is exactly what keeps every step genuinely reversible.

  4. 4

    Move workloads on your own schedule

    Windows Update tends to come second, since it opens the road to Autopatch. After that, endpoint protection, resource access, the Office applications, device configuration and client applications, ordered around wherever your existing investment sits. Throughout all of it, everything not yet moved carries on being managed exactly as it always was.

  5. 5

    Decide the end state deliberately

    Either fully cloud, or a deliberate long-term hybrid in which Configuration Manager keeps doing whatever it does uniquely well for you. Both are entirely respectable destinations. The thing that causes trouble is drifting into a half-finished arrangement nobody actually selected, which is why we put the question on the table at the beginning and then again once the first workloads have landed.

Straight answers

What organizations ask about moving from Configuration Manager to Intune.

You do not, and this single fact unblocks more of these projects than anything else we tell people. The documented position is that switching workloads is optional and can be done individually whenever you are ready, with everything left behind continuing to be managed as before, alongside all the features outside co-management entirely. No forced cutover exists and there is no moment where your existing platform stops working.

Considerably more than people anticipate. The published list of what enrolling existing clients delivers runs to Conditional Access with device compliance, remote actions covering restart and remote control and factory reset, centralized health visibility, users and devices and applications linked through the directory, and modern provisioning. In a lot of organizations that opening phase turns out to be the entire business case by itself.

There are seven, covering compliance, Windows Update, resource access, endpoint protection, device configuration, the Office Click-to-Run applications and general client applications. Authority over each can be transferred independently of the others, and every one of them can be piloted against a separate collection before you expose a larger population to the change.

Compliance, in the overwhelming majority of estates, for a simple reason: Conditional Access consumes device compliance, and Conditional Access is usually what prompted somebody to start this conversation in the first place. Windows Update tends to follow, opening the route to Autopatch. Leave device configuration and client applications until much later, since between them they carry the deepest existing investment and by far the most packaging work.

You can, and importantly you can do it per workload rather than once for the whole program. Each one gets piloted against a separate collection so the new functionality is exercised on a small population first. That capability is what makes every step a contained and observable change, as opposed to an act of faith accompanied by a rollback plan nobody has ever rehearsed.

It is not, and the documentation tackles this confusion head on: one is a management option and the other an identity option, with an explicit note that customers routinely conflate them. There is a genuine interaction, since machines must be joined or hybrid joined before they can participate, but these remain two separate decisions with two separate bodies of work behind them.

Probably not all of them, and this deserves checking before anything else happens. Machines have to be genuinely connected to the directory, either hybrid joined or fully joined. Anything merely registered, sometimes described as workplace joined, is not supported. Practically every estate contains a population like that, and identifying it in advance costs far less than discovering it partway through a pilot.

Partly at best, and the documentation is refreshingly candid on the point. On its own this is not a solution for remotely connected Windows machines, because the client still has to communicate with its assigned site regardless. A cloud management gateway is what addresses that gap. Neither one requires the other, though in practice organizations very commonly end up deploying both.

The stated prerequisites are directory licensing at P1 or P2, with a note that an Enterprise Mobility and Security subscription covers both that and Intune, plus at least one Intune license so an administrator can reach the admin center. Beyond that, there is separate product and licensing guidance on whether individual users need licenses, and we would strongly suggest reading it rather than assuming an answer in either direction.

It is not, and the difference becomes important the moment a non-Microsoft management platform is involved. Running Configuration Manager on machines enrolled in a third-party service is coexistence. Where both platforms are Microsoft they balance workloads between themselves so conflicts do not arise; that cooperation simply does not exist with an outside service, and coexistence therefore carries documented management limitations.

You can, and for a decent number of organizations that is genuinely the correct destination. The whole design premise is that you use whichever technology serves a given workload best, and there remain capabilities the older platform holds that co-management does not cover. The only thing we would argue with is arriving at a half-migrated state through inertia. Choosing a stable hybrid deliberately is a fine outcome; drifting into one is not.

Getting co-management enabled and collecting the immediate value runs four to eight weeks. Everything after that moves at whatever speed you set, and we have seen both extremes: one workload per quarter at one client, three inside a month at another. Since everything unswitched carries on being managed as before, going slowly costs you nothing and no deadline turns into a cliff. For tracking, the co-management dashboard showing which machines are genuinely co-managed is the only honest measure of where you are.
Before starting

Fifteen questions worth answering first.

Group one covers prerequisites, and more than one of them will halt a project on day two if left unchecked. Group two is about sequence. Group three asks what ultimately becomes of Configuration Manager, which deserves a genuine answer rather than the vague intention most organizations are carrying.

Prerequisites

  • Are devices Entra joined or hybrid joined?
    Registered-only devices are not supported.
  • Do you have Entra ID P1 or P2?
    A stated licensing prerequisite.
  • Is your Configuration Manager version supported?
    A supported current branch version is required.
  • Is Windows automatic enrollment enabled?
    Part of the Intune setup prerequisites.
  • Do you have devices that never reach the site?
    That is a cloud management gateway question.

Sequencing

  • Which workload delivers most for least disruption?
    Usually compliance policies.
  • Which collection would you pilot with?
    Piloting is per workload and per collection.
  • Is Windows Autopatch in the plan?
    It follows the Windows Update workload moving.
  • How much application packaging sits behind client apps?
    Usually the largest single piece of work.
  • Are there workloads you never intend to move?
    A legitimate answer, and worth recording.

The end state

  • Is the goal cloud-only, or a stable hybrid?
    Both are valid. Deciding matters.
  • What does Configuration Manager still do uniquely for you?
    Frequently more than people expect.
  • Who has Configuration Manager full administrator rights?
    Required to enable co-management.
  • Do you have more than one Configuration Manager instance?
    Multiple can connect to one Intune tenant.
  • Who reviews the co-management dashboard?
    It shows which machines are actually co-managed.
Related reading

The pages around this one.

Microsoft Intune

The destination platform, covering enrollment, configuration profiles, compliance and application deployment.

Learn more

Windows Autopilot

Modern provisioning, listed among the immediate benefits of co-management and usually the most visible one.

Learn more

Windows Autopatch

Where update management goes once the Windows Update workload has moved to Intune.

Learn more
Next step

Start with the phase that requires you to move nothing.

Enrolling existing Configuration Manager clients delivers Conditional Access with device compliance, remote actions and Autopilot provisioning without switching a single workload. It proves the model is safe and it is usually the business case for everything that follows.

Book a migration reviewSee Microsoft Intune services

Related Services

Explore more solutions that work great with this service

Microsoft Intune

Device management and endpoint security

Learn more
GR IT SERVICES

IT services for US businesses,
delivering enterprise-grade solutions
remotely, coast to coast.

Microsoft CSP PartnerApple Jamf PartnerCISGuard

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support USA
  • IT AMC USA
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • hello@gritservices.io
  • gritservices.io

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie PolicyCCPA/CPRA