Should we manage Windows devices with Intune or Group Policy?

Key facts

• Group Policy needs line of sight to a domain controller; Intune works over the internet.
• Intune Group Policy analytics shows which GPO settings have an Intune equivalent.
• The settings catalog and security baselines cover most modern Windows settings.
• When both apply the same setting, results can conflict; decide which tool owns each area.
• Many old GPOs are obsolete and should be dropped, not migrated.

The core difference

Group Policy is built for domain-joined PCs on the corporate network. Policies refresh when the device talks to a domain controller, which is unreliable for remote workers unless they are on VPN.

Intune is a cloud service. Devices check in over the internet, so policy, apps, updates and compliance work for a laptop at home the same as one in the office. Intune also feeds device compliance into Conditional Access, which Group Policy cannot do.

How to move from GPOs to Intune

• Export your GPOs and import them into Group Policy analytics in Intune to see which settings map to MDM settings.
• Sort settings into keep, replace with a modern equivalent, or drop. Old IE, drive map and legacy logon script settings are common drops.
• Start from the Intune security baselines and settings catalog rather than copying every GPO one for one.
• Use ADMX ingestion or imported ADMX templates for application settings that have no built-in equivalent.
• Replace logon scripts and drive maps with OneDrive, SharePoint, Intune scripts or remediations.
• Pilot on a small device group, compare results, then expand.

Running both during the transition

Hybrid joined devices can receive Group Policy and Intune policy at the same time. To avoid conflicts, decide which tool owns each area, such as Intune for security baselines, BitLocker, Windows Update and Defender, while Group Policy keeps only what has not moved yet.

The MDM wins over GP policy setting can make Intune take precedence for overlapping settings on supported policies. Use it carefully, after testing, because it changes behavior for every overlapping setting it covers.

Organizations with Configuration Manager can use co-management to shift workloads to Intune one at a time.

When Group Policy still makes sense

Servers stay on Group Policy, since Intune is for client devices. Specialized PCs that never leave the building and run legacy apps may also stay domain joined for a while. The aim is not to delete every GPO on day one but to make sure user devices do not depend on them.

How Accred Consulting approaches it

Accred Consulting starts by exporting and reviewing your GPOs with Group Policy analytics and interviewing IT about what each one is for. The proposal lists which settings move to Intune, which are replaced and which are dropped, plus pricing and timeline. Our US-based specialists build Intune configuration profiles, baselines, update rings and compliance policies, pilot them on real devices and expand in waves with check-ins. At handover you get documentation mapping old GPOs to new policies and knowledge transfer for your team, with optional support for ongoing device management.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions