Listen to this Post
Introduction:
For years, IT administrators have debated whether System Center Configuration Manager (SCCM) would eventually be replaced by Microsoft Intune. The reality is more nuanced: SCCM isn’t going away—it’s evolving. Microsoft Intune is rapidly becoming the preferred solution for modern endpoint management, particularly in cloud and hybrid environments, yet many enterprises are discovering that the optimal approach isn’t choosing one over the other, but rather combining the strengths of both through co-management. This hybrid strategy enables organizations to gradually migrate to the cloud while maintaining control over complex on-premises workloads, delivering unified device management, enhanced security, and the flexibility to adapt to changing business requirements.
Learning Objectives:
- Understand the strategic benefits of co-management between SCCM and Microsoft Intune in hybrid and cloud-first environments.
- Master the step-by-step configuration of Azure services, cloud attach, and client settings to enable co-management.
- Learn to leverage PowerShell, command-line tools, and Microsoft Graph to automate device enrollment, enforce compliance, and troubleshoot endpoint management issues.
You Should Know:
1. Co-Management Architecture: Bridging On-Premises and Cloud
Co-management enables Windows 10 and later devices to be managed simultaneously by both Configuration Manager (SCCM) and Microsoft Intune. This approach allows organizations to leverage Intune’s cloud-based capabilities—such as modern device management, conditional access, and Zero-Touch provisioning—while retaining SCCM’s strengths in complex OS deployment, software metering, and granular server control. The key insight is that co-management serves as a bridge for companies gradually transitioning from traditional IT to modern endpoint management.
Prerequisites for Co-Management:
Before enabling co-management, ensure your environment meets these requirements:
- Azure AD (or Hybrid Azure AD Join) configured
- Active Microsoft Intune subscription
- SCCM Current Branch deployed
- Windows 10/11 devices targeted for management
- Azure AD credentials with Global Administrator permissions
Step-by-Step Guide to Enable Co-Management:
- Configure Azure Services in Configuration Manager – Open the Configuration Manager Console, navigate to Administration → Cloud Services → Cloud Attach. Select Configure Cloud Attach and sign in using an Azure AD account with Global Admin privileges.
-
Enable Co-Management – In the SCCM console, go to Administration → Cloud Services → Co-Management. Select Enable Co-Management and connect your SCCM instance to Intune by providing your Azure tenant ID, application ID, and secret key.
-
Configure Client Settings for Entra-ID Registration – Navigate to Administration → Client Settings and enable the policy for “Enroll new Windows 10/11 devices in Microsoft Intune”. This ensures that SCCM-managed clients automatically register with Azure AD and enroll in Intune.
-
Assign Pilot Collections – In the Co-Management properties, select which device collections should be included in the pilot group. It is critical to first test co-management on a pilot group before rolling out to all SCCM-managed devices.
-
Monitor Co-Management – After configuration, monitor the enrollment status in the SCCM console under Monitoring → Co-Management to verify that devices are successfully enrolled.
-
Automating Device Enrollment with PowerShell and Command-Line Tools
For IT administrators managing large fleets of Windows devices, automation is essential. PowerShell provides precise control over Intune enrollment and device management, enabling scalable endpoint setups.
Verify Device Enrollment Status:
Connect to Microsoft Graph
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Retrieve all Intune-managed devices
Get-MgDeviceManagementManagedDevice
Filter for a specific device
Get-MgDeviceManagementManagedDevice | Where-Object {$_.DeviceName -eq "DESKTOP-XXXXX"}
Trigger Intune Enrollment Manually:
From an elevated Command Prompt, you can force enrollment using:
dsregcmd.exe /join
This command triggers Azure AD join and, if MDM enrollment is configured via Group Policy or automatic enrollment settings, will subsequently enroll the device in Intune.
Bulk Enrollment via PowerShell (Windows Autopilot):
For zero-touch bulk enrollment, capture device hardware IDs and register them with Intune:
Install the WindowsAutopilot module Install-Module -1ame WindowsAutopilotIntune -Force Get the device hardware hash Get-WindowsAutopilotInfo -Online -GroupTag "Finance"
This script uploads the device’s hardware hash directly to Intune, enabling Autopilot provisioning without manual intervention.
- Migrating Workloads from SCCM to Intune: A Phased Approach
One of the most powerful features of co-management is the ability to gradually shift specific workloads from SCCM to Intune. This allows organizations to test Intune’s capabilities incrementally while maintaining operational continuity.
Workloads That Can Be Migrated:
- Device Configuration – Move from SCCM baseline policies to Intune device configuration profiles.
- Windows Updates – Transition from SCCM software update management to Intune’s Windows Update for Business policies.
- Resource Access – Shift VPN, Wi-Fi, and certificate profiles to Intune.
- Endpoint Protection – Migrate Defender and security policies to Intune.
Step-by-Step Migration Process:
- Assess Your Current Environment – In the ConfigMgr console, navigate to Administration → Cloud Services → Co-management and review each workload currently managed by SCCM.
-
Move Workloads in Stages – Open the co-management properties and navigate to the Workloads tab. For each workload, select “Intune” or “Pilot Intune” to begin shifting management to the cloud.
-
Monitor and Validate – After moving a workload, monitor device compliance and user experience using Intune’s reporting tools and SCCM’s monitoring dashboards.
-
Complete the Transition – Once all workloads are successfully managed by Intune and you have validated the environment, you can consider decommissioning the SCCM infrastructure.
4. Enforcing Security and Compliance with Intune Policies
Intune provides robust compliance and configuration policy frameworks that integrate seamlessly with Azure AD Conditional Access. PowerShell can be used to programmatically retrieve, create, and manage these policies.
Retrieve Compliance Policies via Microsoft Graph PowerShell:
Connect to Microsoft Graph with appropriate permissions Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All" Get all device compliance policies Get-MgDeviceManagementDeviceCompliancePolicy Get a specific compliance policy by ID Get-MgDeviceManagementDeviceCompliancePolicy -DeviceCompliancePolicyId "policy-id-here"
Common Compliance Policy Settings:
- Require BitLocker encryption on all Windows devices
- Enforce minimum OS version (e.g., Windows 10 22H2 or later)
- Require antivirus protection (Microsoft Defender) to be active
- Block jailbroken or rooted devices
- Require device to be within a specific compliance window
Deploy Custom Compliance Scripts (Windows Only):
For scenarios not covered by built-in policies, Intune supports custom PowerShell scripts for compliance detection:
Example: Check if a specific registry key exists (compliance = true if found)
$regPath = "HKLM:\SOFTWARE\MyCompany\Security"
if (Test-Path $regPath) {
Write-Output "Compliant"
exit 0
} else {
Write-Output "Non-Compliant"
exit 1
}
Upload this script in the Intune admin center under Endpoint Security → Device Compliance → Scripts → Add.
5. Troubleshooting Common Co-Management and Enrollment Issues
When implementing co-management, administrators often encounter enrollment failures, policy conflicts, or connectivity issues. Here are essential troubleshooting techniques.
Check Device Enrollment Status:
From an elevated Command Prompt, run:
dsregcmd.exe /status
This command provides detailed information about Azure AD join status, MDM enrollment, and SSO state.
Verify MDM Authority:
Get-MgDeviceManagementMobileAppManagementPolicies
Common Enrollment Logs:
- Device Management Log: `%windir%\system32\config\systemprofile\AppData\Local\MDM`
– Azure AD Join Log: `%windir%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SettingSync`
– Intune Management Extension Logs: `%ProgramData%\Microsoft\IntuneManagementExtension\Logs`
Reset MDM Enrollment:
If a device fails to enroll, you can reset the MDM configuration using:
Remove existing MDM enrollment Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Enrollments" -Recurse | Remove-Item -Force Restart the Device Management service Restart-Service -1ame "DmEnrollmentSvc"
After resetting, trigger a new enrollment with `dsregcmd.exe /join` or via the Settings app.
Hybrid Azure AD Join Considerations:
For devices joined to on-premises Active Directory, ensure that the Service Connection Point (SCP) is correctly configured in Azure AD Connect and that the device can reach Azure AD endpoints.
6. Security Hardening for Co-Managed Environments
Co-management introduces new attack surfaces, particularly around Azure AD authentication and cloud-based policy enforcement. Implement these security best practices:
- Enable Conditional Access Policies – Require compliant devices for access to corporate resources. Use Intune compliance policies as a condition in Azure AD Conditional Access.
-
Implement Just-In-Time (JIT) Access – Restrict administrative access to SCCM and Intune consoles using Azure AD Privileged Identity Management (PIM).
-
Encrypt All Endpoints – Enforce BitLocker via Intune device configuration profiles and monitor encryption status through compliance dashboards.
-
Use App Protection Policies – For mobile and BYOD scenarios, deploy Intune App Protection Policies to secure data within managed applications, regardless of the device’s enrollment status.
-
Audit and Monitor – Regularly review audit logs in both SCCM and Intune. Use Azure Sentinel or Microsoft 365 Defender to correlate security events across the hybrid environment.
PowerShell Command to Enforce BitLocker Encryption:
Retrieve BitLocker compliance status for all managed devices
Get-MgDeviceManagementManagedDevice | ForEach-Object {
$deviceId = $_.Id
Get-MgDeviceManagementManagedDevice -ManagedDeviceId $deviceId |
Select-Object DeviceName, ComplianceState, BitLockerEncryption
}
What Undercode Say:
- Key Takeaway 1: Co-management is not a temporary workaround but a strategic evolution. Organizations that embrace the hybrid model today will be better positioned for full cloud migration tomorrow, without disrupting existing operations.
-
Key Takeaway 2: Automation is the cornerstone of modern endpoint management. Mastering PowerShell, Microsoft Graph, and command-line tools is no longer optional—it is essential for scalable, secure, and efficient device management at enterprise scale.
-
Key Takeaway 3: Security must be baked into every layer of the co-management architecture. From conditional access and compliance policies to BitLocker encryption and audit logging, a proactive security posture reduces risk and ensures regulatory compliance in hybrid environments.
Analysis:
The shift from SCCM to Intune is not a binary choice but a continuum. Organizations that treat co-management as a strategic enabler—rather than a temporary migration step—gain the best of both worlds: SCCM’s mature on-premises capabilities and Intune’s cloud-1ative agility. However, this hybrid approach demands a new skill set. IT teams must become proficient in cloud identity management, PowerShell automation, and security policy enforcement across disparate environments. The organizations that invest in upskilling their administrators and building robust automation pipelines will emerge as leaders in the modern endpoint management landscape. Those that delay this transition risk falling behind as Microsoft continues to innovate in the cloud space, gradually deprecating legacy features and shifting investment toward Intune and Microsoft Endpoint Manager.
Prediction:
- +1 Co-management will become the de facto standard for enterprise endpoint management by 2027, with over 70% of mid-to-large organizations adopting a hybrid SCCM/Intune strategy.
- +1 PowerShell and Microsoft Graph will increasingly replace manual console operations, leading to a new generation of “automation-first” IT administrators who treat infrastructure as code.
- -1 Organizations that fail to migrate key workloads to Intune within the next 18–24 months will face escalating operational costs and security gaps as SCCM on-premises infrastructure ages and Microsoft reduces support for legacy features.
- +1 The integration of AI-driven analytics into Intune will revolutionize compliance monitoring and threat detection, enabling proactive remediation before issues impact end-users.
- -1 The complexity of hybrid identity management (Azure AD join vs. Hybrid Azure AD join) will continue to be a major pain point, leading to enrollment errors and security misconfigurations in poorly planned deployments.
- +1 Windows Autopilot and zero-touch provisioning will become the primary onboarding method for new devices, drastically reducing IT helpdesk workload and improving employee experience.
- -1 Security teams must remain vigilant: co-management environments introduce new attack vectors through cloud APIs and service principals, requiring continuous monitoring and strict privilege management.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Nimra Aftab – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
