Moving away from CM to Intune

Ru Thanks for the response.

I suppose its the ideal way but the way I understand it for a short time they going to need to run both CM and Intune using Co-management/cloud attach sort of makes sense as it then means they can begin to make that transition. 

For existing devices on 1709, would AP make sense using AP for existing devices (I didnt think it was supported on 1709) or wouldn't it be better to deploy a new image from CM, hybrid AD join and then move that device as Intune managed going forward with future deployments through AP. 

The reality is this organisation has 5000 users and is on a transformation programme which means moving from one identity in AD to AAD would mean a lot more work to ensure users can access both legacy systems and modern. 

I am open to suggestions if there is a better way for them to move devices to Intune only, ditch CM and use only AAD but concern is what about legacy apps and system to run on-premises?

I know the customer is keen for client management over the intranet as its like that working remotely for their workforce will become the norm. 

Thank