Event banner
Event details
To add to this question, if I enable Intune policy management slider via co-management in configuration manager. Is on prem group policy still honored in a hybrid scenario while we start migrating policies? How does it handle conflicts between on prem and Intune?
- Jason_Sandys
Microsoft
Yes and no. Conflicts are possible and likely. Co-management is not about arbitrating between group policy and Intune. The best way to avoid these conflicts is not attempt to apply the same policy or settings from two different authorities as this will lead to hardship and confusion. Use selective targeting in either group policy (using WMI filters, OUs, groups, etc) or in Intune (using Entra ID groups or filters) if and as needed to avoid conflicts is the path of least resistance here. - Jason_SandysYes and no. Conflicts are possible and likely. Co-management is not about arbitrating between group policy and Intune. The best way to avoid these conflicts is not attempt to apply the same policy or settings from two different authorities as this will lead to hardship and confusion. Use selective targeting in either group policy (using WMI filters, OUs, groups, etc) or in Intune (using Entra ID groups or filters) if and as needed to avoid conflicts is the path of least resistance here.
- I've seen it apply some items and not apply others. I know stuff around security like firewalls just reset to Windows default config and blow out all group policy firewall rules. but others seem to apply without issue. Would be nice to see a reference list to see how all this stuff gets handled
- Joe_Lurie
Nathan_Lockwood and Anthonymelwhrhs GPO and Configuration Manager policies are unrelated. If you move a slider in the co-management console, it should not affect the GPOs applying, except maybe WSUS/WUfB policies. But other group policies should not be impacted by the co-management confoguration.
Joe_Lurie Reading a little more about workload shift I "Get it" now. Thank you for your reply and pushing me to dig deeper on the the actual function. The other big take away is don't have Group policy and Intune profiles do the same thing. I guess to push the client to Intune configuration over GPO I can enable the MDM wins Over GPO Policy. Thanks again
