Co-management workloads

You don't have to switch any of the workloads. When you're ready, you can switch them individually, several at once, or all at the same time. However, until you switch the workloads over to Intune, Configuration Manager continues to manage the workloads that you don't switch to Intune, along with all other features of Configuration Manager that co-management doesn't support.

If you switch a workload to Intune, but later change your mind, you can switch it back to Configuration Manager, although there might be an impact. For example, Windows and Office versions will remain at a later version if installed by Intune.

Co-management supports the following workloads:

• Compliance policies

• Windows Update policies

• Resource access policies

• Endpoint Protection

• Device configuration

• Office Click-to-Run apps

• Client apps

Compliance policies

Compliance policies define the rules and settings that a device must comply with to be considered compliant by conditional access policies. Also use compliance policies to monitor and remediate compliance issues with devices independently of conditional access. You can add evaluation of custom configuration baselines as a compliance policy assessment rule. For more information, see Include custom configuration baselines as part of compliance policy assessment.

For more information on the Intune feature, see Use compliance policies to set rules for devices you manage with Intune.

Windows Update policies

Windows Update for Business policies let you configure deferral policies for Windows 10 or later feature updates or quality updates for Windows 10 or later devices managed directly by Windows Update for Business.

For more information on the Intune feature, see Manage Windows software updates in Intune.

Resource access policies

Resource access policies configure VPN, Wi-Fi, email, and certificate settings on devices.

For more information on the Intune feature, see Deploy resource access profiles.

Endpoint Protection

The Endpoint Protection workload includes the Defender suite of protection features:

• Microsoft Defender Antivirus
• Microsoft Defender Application Guard
• Microsoft Defender SmartScreen
• Microsoft Defender for Endpoint (formally known as Windows Defender Advanced Threat Protection)
• Windows Defender Firewall
• Windows Encryption (also known as BitLocker)
• Windows Defender Exploit Guard
• Windows Defender Application Control
• Windows Defender Security Center

For more information on the Intune feature, see Windows 10 (and later) settings to protect devices using Intune.

Device configuration

The device configuration workload includes settings that you manage for devices in your organization. Switching this workload also moves the Resource Access and Endpoint Protection workloads.

You can still deploy settings from Configuration Manager to co-managed devices even though Intune is the device configuration authority. This exception might be used to configure settings that your organization requires but aren't yet available in Intune. Specify this exception on a Configuration Manager configuration baseline. Enable the option to Always apply this baseline even for co-managed clients when creating the baseline. You can change it later on the General tab of the properties of an existing baseline.

To use Windows Autopatch with these devices, this workload needs to be managed by Intune. For more information, see Prerequisites for Windows Autopatch.

For more information on the Intune feature, see Create a device profile in Microsoft Intune.

Office Click-to-Run apps

This workload manages Microsoft 365 Apps on co-managed devices.

• After moving the workload, the app shows up in the Company Portal on the device

• Office updates may take around 24 hours to show up on client unless the devices are restarted

• There's a global condition that's added by default as a requirement to new Microsoft 365 applications. When you transition this workload, co-managed clients don't meet the requirement on the application. Then they don't install Microsoft 365 deployed via Configuration Manager. The global condition is named either:

  • Microsoft 365 apps managed by Microsoft Intune (version 2111 or later)
  • Are Office 365 applications managed by Intune on the device (version 2107 and earlier)

Updates can be managed using either of the following features:

• Use Update Channel and Target Version settings to update Microsoft 365 with Microsoft Intune Administrative Templates
• Manage Microsoft 365 Apps with Configuration Manager.

For more information on the Intune feature, see Add Microsoft 365 apps to Windows devices with Microsoft Intune.

Client apps

Use Intune to manage client apps and PowerShell scripts on co-managed Windows 10 or later devices. After you transition this workload, any available apps deployed from Intune are available in the Company Portal. Apps that you deploy from Configuration Manager are available in Software Center.

For more information on the Intune feature, see What is Microsoft Intune app management?

When you enable Microsoft Connected Cache on your Configuration Manager distribution points, they can serve Microsoft Intune Win32 apps to co-managed clients. For more information, see Microsoft Connected Cache with Configuration Manager.

Diagram for app workloads

Next steps

How to switch workloads