SCCM to Intune: Co-management (2026 Guide)

SCCM isn’t dead. The collections, deployments, reports and WSUS/SUP chain you’ve built over the years — all still in place and working. But we’re in a world where SCCM alone isn’t enough: device-based Conditional Access, managing remote devices that never come to the office, modern provisioning with Windows Autopilot, Intune-based remote wipe/lock… none of these come with the classic, on-prem SCCM setup.

The good news: the choice isn’t "SCCM or Intune." With co-management, a single Windows device is managed by both SCCM and Intune at the same time. You keep your SCCM investment as-is, cloud-attach it, and you decide which workload moves to Intune and when — not overnight, but slider by slider, at your own pace.

This guide is for someone like you who has run SCCM for years: we’ll clear up the terminology, list the prerequisites, show the two paths and the workloads, and most importantly — discuss which workload to move first.

First, terminology clarity (the most confused area)

• Co-management: a Windows device managed by SCCM + Intune at the same time. SCCM client + Intune enrollment together. Workloads are shared between the two.
• Tenant attach: a lighter first step. Makes SCCM devices visible in the Intune admin center and open to some remote actions, without full Intune enrollment. A low-risk start before co-management.
• Cloud attach: the umbrella term — the general name for connecting SCCM to the M365 cloud; co-management and tenant attach are its paths.
• Coexistence: SCCM + a third-party MDM. Not co-management; there’s no workload orchestration, and it’s limited.

And the most critical distinction: co-management is a management option; Entra Hybrid Join is an identity option. They work together but are not the same. The device must have an identity in Entra, then you bring it into co-management.

Prerequisites

License: Entra ID P1 or P2 and an Intune license assigned at least to your (admin) account. (An EMS subscription includes both.) Don’t forget to assign an Intune license to the admin account; otherwise the admin center sign-in errors out.

Configuration Manager: a supported Current Branch version. If you’ll manage internet-facing (off-office) clients you need the Cloud Management Gateway (CMG) — not required for co-management but used alongside it.

Entra ID — identity (critical condition): devices must be Entra hybrid joined or Entra joined. Devices that are only "Entra registered" (workplace joined) are NOT supported in co-management. So the device must have a real join state; to set up device identity see Entra Hybrid Join configuration.

Intune: Intune set up and Windows automatic enrollment enabled.

Windows: a Windows version Intune supports.

Roles: Azure Subscription Manager for the CMG setup; Global Administrator to create the Entra apps; SCCM Full Administrator (All scope) to enable co-management.

Two paths

1. Existing SCCM clients: devices that are already SCCM clients. You set up Entra hybrid join and enroll these devices into Intune. This is most likely your environment.
2. New, internet-based devices: new devices that join Entra and auto-enroll into Intune; then you install the SCCM client to reach co-management state.

Workloads: shift slider by slider

The beauty of co-management is that it’s not "all or nothing." You move each workload separately when you’re ready; what you don’t move stays managed by SCCM. The transferable workloads:

• Compliance policies
• Windows Update policies
• Resource access policies
• Endpoint Protection
• Device configuration
• Office Click-to-Run apps
• Client apps

You can move each workload onto a separate pilot collection first, test it, and open it to a larger group once there are no problems.

Which first? — Compliance

My field advice is clear: move the Compliance policies workload to Intune first. The reason ties this whole series together: Intune device compliance feeds the Conditional Access "require compliant device" condition. So this single move brings your SCCM devices into modern, device-based access control. You get the highest return earliest here.

Step-by-step (recommended, low-risk order)

1. Prepare the Entra identity: are devices hybrid joined? If not, solve that first — co-management can’t be set up without identity.
2. Start with tenant attach (optional but recommended): make SCCM devices visible in the Intune admin center. Low risk, quick value.
3. Enable Intune automatic enrollment and assign an Intune license to the admin account.
4. Enable co-management in SCCM: open the cloud attach / co-management configuration. At the start, choose a Pilot scope — not the whole estate, a pilot collection.
5. Target the pilot collection: move the Compliance workload to Intune here first. Watch behavior from the co-management dashboard.
6. Verify: are the pilot devices both SCCM clients and Intune enrolled? Is compliance evaluated in Intune and flowing to Conditional Access?
7. Expand gradually: if there are no issues, move the workload from "Pilot" to a broader group; then move the next workload (e.g. Windows Update) with the same discipline.

Field pitfalls

• Diving into co-management and skipping identity. It won’t work if the device isn’t Entra joined/hybrid joined; "Entra registered" isn’t enough.
• Not assigning an Intune license to the admin account. The admin center throws an "unexpected error" and you hunt in the wrong place for hours.
• Moving workloads all at once, without a pilot. Pilot each workload on a pilot collection first. If SCCM and Intune manage the same setting at the same time, conflict is inevitable.
• Expecting internet-based clients without a CMG. Devices that never come to the office can’t reach the SCCM side’s site without a CMG.
• Mistaking co-management for Hybrid Join. One is management, the other identity. Plan them separately, run them together.
• The "we’re shutting SCCM down now" rush. The point of co-management isn’t to retire SCCM overnight; it’s to bridge to the cloud while keeping your investment.

Conclusion

Co-management is the bridge to modern endpoint management without throwing away your SCCM investment. Give devices an Entra identity (hybrid/Entra joined), start with tenant attach, enable co-management in a pilot scope, and shift workloads — compliance first — slider by slider to Intune. That way you keep the SCCM infrastructure you’ve built for years while gaining cloud capabilities like Conditional Access, Autopilot and remote management. The modern direction is Intune; but you get there by crossing a controlled bridge, not by jumping.