The path from Configuration Manager to Intune
Moving from Configuration Manager to Microsoft Intune is not a cutover. Microsoft describes co-management as one of the primary ways to attach an existing Configuration Manager deployment to the Microsoft 365 cloud, and the mechanism by which authority for each management workload moves from the on-premises site to Intune one workload at a time (Microsoft Learn, What is co-management?, accessed 2026-10-20). The path EPC Group runs has five stages: confirm the identity and licensing prerequisites, enable co-management, switch workloads through pilot collections in a deliberate order, repackage applications for Intune, and decide whether Configuration Manager is retired or kept for what it still does well. Each stage has a Microsoft-documented control behind it, and the order matters because some workloads unlock others. The work sits inside EPC Group's Microsoft 365 consulting practice, alongside the Conditional Access and identity design that co-management makes possible.
What co-management is
When a Windows device has the Configuration Manager client and is enrolled in Intune, both services manage it. The administrator controls which workloads, if any, switch authority to Intune, and Configuration Manager continues to manage everything else, including features co-management doesn't support. Any workload can first be piloted with a separate collection of devices. Microsoft lists the immediate value of enrolling existing clients as Conditional Access with device compliance, Intune remote actions such as restart, remote control and factory reset, centralized visibility of device health, links between users, devices and apps in Microsoft Entra ID, and modern provisioning with Windows Autopilot. There are two paths in: existing Configuration Manager clients that are hybrid joined and then enrolled in Intune, and new internet-based devices that join Microsoft Entra ID, enroll automatically and then receive the Configuration Manager client. Microsoft is explicit that co-management alone doesn't manage remotely connected devices; those still need a cloud management gateway to reach their site (Microsoft Learn, What is co-management?, accessed 2026-10-20).
Prerequisites: identity, licensing and the site
Identity is the prerequisite that delays most projects. Devices must be Microsoft Entra hybrid joined, meaning joined to on-premises Active Directory and registered with Microsoft Entra ID, or Microsoft Entra joined; devices that are only Microsoft Entra registered aren't supported. Licensing requires Microsoft Entra ID P1 or P2 and at least one Intune license for the administrator who signs in to the Microsoft Intune admin center, and Microsoft notes that an Enterprise Mobility + Security subscription includes both. The site must run a supported version of Configuration Manager current branch, several Configuration Manager instances can connect to one Intune tenant, Windows automatic enrollment must be enabled in Intune, and enabling co-management needs a Configuration Manager Full Administrator with All scope rights (Microsoft Learn, What is co-management?, accessed 2026-10-20). EPC Group's Microsoft Entra ID practice typically completes hybrid join and cleans up duplicate device objects before co-management is switched on.
Which workloads move first, and why
Co-management supports seven workloads: compliance policies, Windows Update policies, resource access policies, Endpoint Protection, device configuration, Office Click-to-Run apps and client apps. Each can move individually, several at once or all together, and a workload can be switched back, though some effects persist; for example, Windows and Office versions stay at a later version if Intune installed them (Microsoft Learn, Co-management workloads, accessed 2026-10-20). On the Workloads tab of the co-management properties each slider is set to Configuration Manager, Pilot Intune or Intune, and each workload can have its own pilot collection on the Staging tab. Microsoft advises configuring the matching Intune policy before switching, and notes that under Pilot Intune, Endpoint Protection and device configuration policies are deployed but not removed when unassigned (Microsoft Learn, How to switch Configuration Manager workloads to Intune, accessed 2026-10-20).
EPC Group's default order starts with compliance policies, because they feed Conditional Access. Windows Update policies come second: Microsoft calls update deployment possibly the most important workload from a security perspective and says it should be the first transitioned for cloud-native endpoints (Microsoft Learn, High level planning guide to move to cloud-native endpoints, accessed 2026-10-20). After it moves, Microsoft says the Configuration Manager client settings for software updates must be adjusted manually. Endpoint Protection and device configuration follow; switching device configuration also moves resource access and Endpoint Protection, resource access is no longer supported in Configuration Manager from version 2203, and Windows Autopatch requires the Windows Update, device configuration and Office Click-to-Run workloads in Intune (Microsoft Learn, Co-management workloads, accessed 2026-10-20). Client apps move last, once packaging is done.
Repackaging applications for Intune
Configuration Manager applications don't transfer to Intune as they are. Windows classic applications are converted with the Microsoft Win32 Content Prep Tool, IntuneWinAppUtil.exe, which compresses a setup folder into one .intunewin file and detects some attributes Intune needs to determine install state. Its parameters name the setup folder, setup file and output folder, with a quiet mode for scripted runs. Apps must install silently, each is capped at 30 GB, and the tool belongs outside the source folder because it zips every file and subfolder it finds (Microsoft Learn, Prepare Win32 App Content for Upload, accessed 2026-10-20). Each package is then added, assigned and monitored in the Microsoft Intune admin center (Microsoft Learn, Add, Assign, and Monitor a Win32 App in Microsoft Intune, accessed 2026-10-20). Until the client apps workload moves, apps deployed from Configuration Manager stay in Software Center and Intune apps appear in the Company Portal; when Microsoft Connected Cache is enabled on distribution points, they can serve Intune Win32 apps to co-managed clients (Microsoft Learn, Co-management workloads, accessed 2026-10-20).
What stays in Configuration Manager, and when it can go
Microsoft documents a fully cloud end state: hybrid join, enable co-management, set up Intune as the MDM authority, slide every workload to Intune, then uninstall the Configuration Manager client (Microsoft Learn, Migration guide: Set up or move to Microsoft Intune, accessed 2026-10-20). The same guide notes that most existing Configuration Manager customers keep using it for on-premises services, and that Configuration Manager supports Windows Server as well as Windows and macOS clients. The planning guide frames three options for Configuration Manager customers: co-management, tenant attach for monitoring from the Intune admin center, or a pure cloud move to Intune (Microsoft Learn, Microsoft Intune planning guide, accessed 2026-10-20). Microsoft describes hybrid join as a transitionary step, not the goal, and has no utility to convert domain-joined or hybrid joined endpoints to Microsoft Entra joined; it recommends resetting and redeploying them during a hardware refresh (Microsoft Learn, High level planning guide to move to cloud-native endpoints, accessed 2026-10-20). EPC Group therefore treats retirement as a separate decision, taken only when servers, task sequences and any macOS clients have a new home.
Documented work
ANON-CASES: EPC Group engagement data for Configuration Manager to Intune migration covers mid-size and large organizations in healthcare, education and the public sector enabling co-management, moving compliance, update, endpoint protection and configuration workloads through pilot collections, and repackaging application catalogs as Win32 apps, delivered by the firm's Microsoft 365 consulting and managed Microsoft services practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- What is co-management? — Microsoft Learn, accessed 2026-10-20
- Co-management workloads — Microsoft Learn, accessed 2026-10-20
- How to switch Configuration Manager workloads to Intune — Microsoft Learn, accessed 2026-10-20
- High level planning guide to move to cloud-native endpoints — Microsoft Learn, accessed 2026-10-20
- Prepare Win32 App Content for Upload — Microsoft Learn, accessed 2026-10-20
- Add, Assign, and Monitor a Win32 App in Microsoft Intune — Microsoft Learn, accessed 2026-10-20
- Migration guide: Set up or move to Microsoft Intune — Microsoft Learn, accessed 2026-10-20
- Microsoft Intune planning guide — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What is co-management, and how are workloads switched?
Co-management is the concurrent management of Windows devices by Configuration Manager and Microsoft Intune: a device has the Configuration Manager client and is enrolled in Intune, and you choose which workloads move to Intune while Configuration Manager keeps the rest (Microsoft Learn, What is co-management?, accessed 2026-10-20). Each workload has a slider on the Workloads tab of the co-management properties, set to Configuration Manager, Pilot Intune or Intune, and Pilot Intune applies only to the pilot collection chosen on the Staging tab. Microsoft advises configuring the matching Intune policy before switching (Microsoft Learn, How to switch Configuration Manager workloads to Intune, accessed 2026-10-20).
What are the prerequisites, such as Microsoft Entra hybrid join and licensing?
Devices must be Microsoft Entra hybrid joined or Microsoft Entra joined; devices that are only Microsoft Entra registered are not supported. Licensing requires Microsoft Entra ID P1 or P2 and at least one Intune license for the administrator who signs in to the Microsoft Intune admin center, and Microsoft notes that an Enterprise Mobility + Security subscription includes both. The site needs a supported version of Configuration Manager current branch, Windows automatic enrollment must be enabled in Intune, and enabling co-management requires a Configuration Manager Full Administrator with All scope rights (Microsoft Learn, What is co-management?, accessed 2026-10-20). Internet-based clients also need a cloud management gateway.
Which workloads move first, and why?
Compliance policies usually move first, because they unlock Conditional Access with device compliance, one of the immediate benefits Microsoft lists for co-management (Microsoft Learn, What is co-management?, accessed 2026-10-20). Windows Update policies follow: Microsoft calls update deployment possibly the most important workload from a security perspective and says it should be the first one transitioned for cloud-native endpoints (Microsoft Learn, High level planning guide to move to cloud-native endpoints, accessed 2026-10-20). Endpoint Protection and Device configuration come next, then Office Click-to-Run apps and Client apps, which depend on repackaged applications (Microsoft Learn, Co-management workloads, accessed 2026-10-20).
How are applications repackaged for Intune?
Windows classic applications are converted with the Microsoft Win32 Content Prep Tool, IntuneWinAppUtil.exe, which compresses the setup folder into a single .intunewin file and detects some of the attributes Intune needs to determine install state. Parameters set the setup folder, setup file and output folder. Apps must support silent installation, each app is capped at 30 GB, and the tool should be kept outside the source folder because it zips every file and subfolder (Microsoft Learn, Prepare Win32 App Content for Upload, accessed 2026-10-20). The package is then added, assigned and monitored in the Microsoft Intune admin center (Microsoft Learn, Add, Assign, and Monitor a Win32 App in Microsoft Intune, accessed 2026-10-20).
When can Configuration Manager be retired?
Microsoft documents a fully cloud path: Microsoft Entra hybrid join, co-management, Intune set up as MDM authority, every workload slid to Intune, and then the Configuration Manager client uninstalled from devices (Microsoft Learn, Migration guide: Set up or move to Microsoft Intune, accessed 2026-10-20). Retirement is realistic only when nothing outside those workloads still depends on the site, such as server management, operating system deployment or macOS clients. Microsoft also notes that most existing Configuration Manager customers keep using it, and that there is no utility to convert hybrid joined devices to Microsoft Entra joined; they are reset and redeployed at hardware refresh (Microsoft Learn, High level planning guide to move to cloud-native endpoints, accessed 2026-10-20).
Talk to a senior architect
If your Configuration Manager site is still the only authority for every workload, a 30-minute discovery call with a senior EPC Group architect sets out the prerequisites to close and the workload order for your estate. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.