Intune vs Group Policy: When to Migrate, What Cannot Move, and How to Run Hybrid Management During Transition

Before planning migration, use the Group Policy Analytics tool in Intune to identify which of your GPO settings have MDM equivalents:

Export your GPOs to XML:

# Export all GPOs to XML files
Get-GPO -All | ForEach-Object {
    $name = $_.DisplayName -replace '[^a-zA-Z0-9]', '_'
    Get-GPOReport -Name $_.DisplayName -ReportType Xml -Path "C:\GPOExports\${name}.xml"
    Write-Host "Exported: $($_.DisplayName)"
}

Import into Intune Group Policy Analytics:

1. Go to Intune admin center: Devices > Group Policy Analytics
2. Import the exported XML files
3. Review the migration readiness report

Interpreting the results:

• Supported: The setting has a direct MDM/Intune equivalent -- migrate these
• Not supported: No MDM equivalent exists -- keep in GPO or accept the gap
• Deprecated: Setting is no longer relevant in modern Windows -- can be removed
• Unknown: Intune could not classify the setting -- review manually

Common categories that typically land in 'Not supported':

• Folder Redirection (no MDM equivalent -- requires on-premises file server)
• Drive Mapping (no MDM equivalent for persistent mapped drives)
• Logon/Logoff scripts (partially: Intune has proactive remediation scripts but not full GPO script support)
• Offline Files (no MDM equivalent)
• Internet Explorer settings (IE is EOL -- migrate to Edge policies)
• Some WMI filter-dependent policies

Start with the categories that have high MDM coverage and low risk of conflict:

High-confidence migration categories:

1. Windows Update settings: Intune's Windows Update for Business ring policies replace WU GPO settings. Migrate these early -- Intune WUfB gives better visibility into update compliance than GPO.

2. BitLocker: Intune's Endpoint Security > Disk Encryption > BitLocker policy maps well to BitLocker GPO settings. Intune also provides escrow key management in Azure AD.

3. Windows Firewall: Intune Endpoint Security > Firewall > Windows Firewall policy covers the same settings as the Windows Firewall GPO. Build your Intune firewall policy in a test group, compare behavior, then expand.

4. Microsoft Edge policies: Intune Administrative Templates include the full Edge ADMX policy set. Edge GPO settings migrate cleanly to Intune Administrative Templates.

5. Defender settings (Antivirus / ASR): Intune Endpoint Security profiles cover the Defender GPO settings comprehensively. The Intune profiles also add cloud-delivered protection controls that GPO lacks.

6. Local admin rights control: Intune Local Administrator Password Solution (LAPS) and the local user/group policy type replace GPO Restricted Groups for local admin management.

Create an Intune Administrative Templates profile for ADMX-backed settings: Devices > Configuration profiles > Create profile > Windows 10 and later > Administrative Templates This ingests the built-in ADMX templates and allows configuring Office, Edge, and Windows ADMX settings via cloud.

Co-management allows ConfigMgr (SCCM) and Intune to manage the same Windows 10/11 device simultaneously. For organizations using ConfigMgr without Intune, co-management is the on-ramp.

Prerequisites:

• ConfigMgr 1906 or later
• Azure AD Connect syncing AD accounts to Azure AD
• Devices hybrid Azure AD-joined or Azure AD-joined
• Intune license for each device (E3 + Intune add-on, E5, or standalone)

Configure co-management in ConfigMgr:

1. ConfigMgr console: Administration > Cloud Services > Co-management
2. Configure the co-management properties: sign in with your Azure AD admin account
3. Set the Automatic enrollment path: Pilot (specific collection) or All (fleet-wide)
4. Configure workload sliders:
   • Configuration Policies: Start at ConfigMgr, move to Intune when policy coverage is validated
   • Windows Update policies: Move to Intune early (WUfB is better in Intune)
   • Compliance policies: Move to Intune early (enables conditional access)
   • Client apps: Keep in ConfigMgr longer (app deployment is mature in SCCM)

For GPO-only environments (no ConfigMgr): Use the Intune auto-enrollment MDM URL via Group Policy: Computer Configuration > Administrative Templates > Windows Components > MDM

• Enable automatic MDM enrollment using default Azure AD credentials: User Credential This triggers MDM enrollment for hybrid Azure AD-joined devices without ConfigMgr.

The most common migration problem: Intune policies appear to apply (show Succeeded in the Intune portal) but the device behavior reflects GPO settings. This happens because GPO wins over MDM for most settings when both are configured.

Detect conflicting GPO settings:

# On a managed endpoint, review MDM enrollment status and conflicts
# Start > Run: ms-settings:workplace OR
# Settings > Accounts > Access work or school > select enrollment > Info

# For detailed MDM diagnostic:
MdmDiagnosticsTool.exe -area DeviceEnrollment;DeviceProvisioning -zip C:\MDMDiag.zip
# Review the resulting zip for policy conflicts

# Check MDM registry for applied policies
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device'

Identify GPO settings that override Intune:

# Run gpresult to see all applied GPO policies on a device
gpresult /H C:\GPResult.html /F
# Open GPResult.html and compare applied settings to your Intune policy intent
# Settings applied via GPO that you expected to control via Intune = conflict

Resolution process:

1. Identify the GPO containing the conflicting setting via gpresult
2. Remove the setting from the GPO (or set it to Not Configured)
3. Wait for Group Policy refresh (gpupdate /force or next cycle)
4. Verify the Intune policy now controls the setting
5. Validate the device behavior matches the Intune policy intent