Microsoft Intune: replace Group Policy through a controlled migration

Replacing GPOs is not a one-for-one conversion

A move to Microsoft Intune should not blindly reproduce twenty years of Group Policy in the cloud. Some GPOs solve problems that no longer exist, others target retired applications, and many controls now belong in Endpoint security, Windows LAPS, Windows Update for Business or compliance policy.

The goal is a device whose expected state is clear, measurable and recoverable. Active Directory and Intune can coexist during the transition, but each setting should have one authority at a time.

• Microsoft — Import and analyze GPOs with Group Policy Analytics ↗

Start with scope and prerequisites

Before changing policy, create a matrix that maps each device population to its current authority, target authority, deployment ring and rollback method.

• Identify targeted devices: Entra joined, hybrid joined, shared, kiosk, remote or intermittently connected.
• Confirm Intune enrollment, licensing, Windows versions and connectivity to Microsoft endpoints.
• Prepare recovery access: emergency accounts, Windows LAPS, BitLocker keys and an unenrollment procedure.
• Separate clients from domain controllers and servers; Intune does not replace management of those roles in the same way.
• Name owners for GPOs, applications, support and risk acceptance.

Step 1 — Inventory the GPOs that actually apply

Capture links, precedence, security and WMI filters, blocked inheritance, enforced links, loopback processing, scripts, preferences and custom ADMX templates. A list of GPO names does not explain the effective result on a device.

The following read-only script exports one XML report per GPO. Run it from an administrative workstation with the GroupPolicy module.

$out = 'C:\Temp\GPO-Export'
New-Item -Path $out -ItemType Directory -Force | Out-Null

Get-GPO -All | ForEach-Object {
    $safeName = ($_.DisplayName -replace '[\\/:*?"<>|]', '_')
    $path = Join-Path $out ("{0}_{1}.xml" -f $safeName, $_.Id)
    Get-GPOReport -Guid $_.Id -ReportType Xml -Path $path
}

Get-ChildItem $out -Filter *.xml |
    Select-Object Name, Length, LastWriteTime

• Microsoft — Get-GPOReport ↗

Step 2 — Use Group Policy Analytics without mistaking compatibility for equivalence

In the Intune admin center, open Devices > Manage devices > Group Policy analytics and import the XML reports. Microsoft requires each file to be under 4 MB and properly Unicode encoded.

The report marks settings as ready for migration, unsupported, deprecated or unknown. MDM Support is a triage tool, not proof that the complete GPO will behave identically. Microsoft also notes that analysis of non-ADMX settings is supported only in English, so localized GPOs can produce inaccurate percentages.

Step 3 — Choose the right Intune policy type

Settings Catalog is the natural starting point for GPO-like settings. It centralizes controls exposed by Windows configuration service providers and lets you select only the settings the organization intends to manage.

Avoid one monolithic profile. Function-based profiles for browser security, user experience, firewall and BitLocker simplify assignments, conflict analysis and rollback.

• Microsoft — Use the Settings Catalog ↗
• Microsoft — Windows administrative templates in Intune ↗

Step 4 — Remove competing authorities

During coexistence, GPO and MDM can target the same setting. The outcome depends on the CSP and the specific control. MDMWinsOverGP is not a universal solution: Microsoft states that it applies to Policy CSP and does not cover equivalent settings delivered through other CSPs such as Defender CSP.

Document each overlap, deploy the Intune profile to a ring, confirm receipt, and then remove the equivalent GPO configuration for that ring. Do not build operations around a synchronization race between two authorities.

• Microsoft — Scope and limits of MDMWinsOverGP ↗

Step 5 — Build rings with exit criteria

Use stable inclusion groups and an emergency exclusion group. Every wave needs an owner, window, success measure and maximum remediation time.

Step 6 — Validate effective configuration on the device

Assigned does not always mean applied. On a pilot device, force synchronization, review remaining GPOs and inspect MDM logs. Windows advanced diagnostics show received policies, certificates and configuration sources.

• Confirm identity and enrollment state with dsregcmd.
• Compare gpresult with expected Intune assignments.
• Review per-setting status, not only overall profile status.
• Test real workflows: VPN, Wi-Fi, printing, Office, business apps, sleep and restart.
• Track errors, conflicts, pending devices and Windows-version gaps.

dsregcmd /status
gpupdate /force
gpresult /h C:\Temp\gpresult.html
start eventvwr.msc

$log = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
Get-WinEvent -LogName $log -MaxEvents 100 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-List

• Microsoft — Monitor configuration profiles ↗

Step 7 — Prepare a realistic rollback

Do not delete the source GPO after the first success. Back it up, retain its XML report, and initially disable only its link or targeting for the migrated ring. Rollback can then exclude the group temporarily from the Intune profile, restore GPO targeting and force synchronization according to the approved procedure.

Some settings do not automatically return to their previous value when an MDM policy is removed. Test removal as carefully as application, and document a restoration value for every sensitive control.

Scenarios that need separate treatment

• Group Policy Preferences: drive maps, printers, scheduled tasks, files and registry values do not always have direct equivalents.
• Startup and logon scripts: identify domain, network and SYSTEM-versus-user context dependencies.
• Certificates, Wi-Fi and VPN: test the trust chain and certificate arrival before requiring authentication.
• User settings with loopback: explicitly rebuild targeting for shared devices, rooms and kiosks.
• Custom ADMX: validate ingestion, versioning and removal; do not assume every historical template remains necessary.
• Servers and domain controllers: retain management appropriate to their roles instead of adding them to a client migration.
• Rarely connected devices: leave enough time to reach travellers, leave cases and spare devices.

Security baselines are a starting point, not a paste operation

Intune security baselines group Microsoft-recommended settings, but applying them wholesale can overlap existing profiles or break a business dependency. Compare their contents with current configuration, assign them to a pilot, and accept or justify each deviation.

Treat a baseline version upgrade as a production change. A recommended setting still requires compatibility testing.

• Microsoft — Security baselines in Intune ↗

Example migration register

Add the owner, groups, pilot date, incidents, validation evidence and final decision. This register becomes the audit trail and prevents a legacy GPO from being deleted before its purpose is understood.

Checklist before retiring a GPO

• The business need and effective setting are confirmed.
• CSP, Windows edition and version compatibility are known.
• The Intune policy does not conflict with another profile.
• The pilot covers representative applications and work patterns.
• Intune reporting and local validation confirm the result.
• Behaviour after policy removal has been tested.
• The GPO backup, exclusion group and rollback procedure exist.
• Support and the control owner have accepted expansion.

Conclusion

Intune can replace much of GPO-based client management, but migration quality depends more on method than on the MDM Support percentage. Inventory the effective result, remove obsolete controls, choose the right policy engine and transfer authority one setting at a time.

Short, measured and reversible coexistence reduces risk. Permanent coexistence where GPO and MDM write the same settings merely transfers that risk to users and support teams.

• Related guide — Deploy Windows LAPS in a hybrid environment →
• Related guide — ASR rules with Intune and Group Policy →