Co-Management for patching

The prerequisites including licensing are detailed in the official docs at https://docs.microsoft.com/en-us/mem/configmgr/comanage/overview#prerequisites. Also, check out https://docs.microsoft.com/en-us/mem/configmgr/core/understand/product-and-licensing-faq#what-changes-with-licensing-for-co-management-in-microsoft-endpoint-manager- as this details the license grant we made a couple of years ago.

As for devices having an AAD identity, yes, this is a requirement for devices to be enrolled in and managed by Intune. This can either be full AAD joined (which is our strong preference for new devices) or hybrid AAD join (which requires AAD Connect and is the path of least resistance for existing devices).