Co-Management for patching

[Andreas_Wi401]

Hi,

I would like to establish Co-Management (ConfigMgr 2103) in order to move the workload of patching to Intune. What are the pre-requisites despite ConfigMgr to be able to use patching via Co-Management? What license do I have to use? Do I have to sync the client into AAD with AD-connect?

Thanks,

Andreas    

[#2]

Hi Andreas,

Just moved to co-management a year ago for 10.000 clients, now moving workloads to Windows Update for Business. Below a summary of the work done.
A goo start and recommended, is (if you have the required subscription) to ask help from Microsoft FastTrack engineers to guide you through the process: https://www.microsoft.com/en-us/fasttrack. It is an excellent service!

Johan

* Step 1: Enable Hybrid AAD Join (AAD connect) --> brings your devices to Azure AD
https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-managed-domains
* Step 2: Enable co-management in ConfigMgr --> configMgr client will do the work for you
https://docs.microsoft.com/en-us/mem/configmgr/comanage/tutorial-co-manage-clients#enable-co-managem...
*Step 3: Tenant/Cloud Attach --> recommended for enhanced device management
* Step 4: you can now start moving workloads to Windows Update for Business.

[#3]

The prerequisites including licensing are detailed in the official docs at https://docs.microsoft.com/en-us/mem/configmgr/comanage/overview#prerequisites. Also, check out https://docs.microsoft.com/en-us/mem/configmgr/core/understand/product-and-licensing-faq#what-change... as this details the license grant we made a couple of years ago.

As for devices having an AAD identity, yes, this is a requirement for devices to be enrolled in and managed by Intune. This can either be full AAD joined (which is our strong preference for new devices) or hybrid AAD join (which requires AAD Connect and is the path of least resistance for existing devices).