Deployment options for Co-Management with your MDM
As we mentioned in our article, “co-management” or co-management is the first fundamental step toward modern management, allowing you to use Windows and configure them “as-is,” while adding a modern management tool. After that, you can move on to Modern Management, since the transition to the modern world won’t happen overnight for most organizations. To achieve this, there are several scenarios, which we describe below:
Clients Windows 10 without ConfigMgr
Option 1: (the only option for clients without ConfigMgr): Hybrid attachments
(Active Directory On-Premise member + Azure AD registered/joined+ GPO to configure automatic enrollment in MDM)
If you are not using ConfigMgr, to enable the “co-management" feature, you simply need to ensure that your Windows Windows 10 (version 1709 and later) clients are configured with the " GPO " setting to allow automatic enrollment in the MDM.
After that, start migrating the configuration from GPO and add a new configuration to MDM instead of using the GPO. Decommission the on-premises infrastructure, such as WSUS , and start relying on Windows Update for Business. Also check AutoPilot.
Clients using ConfigMgr (System Center Configuration Manager – SCCM)
Option 2: Hybrid attachments (with co-management in ConfigMgr not configured)
(Active Directory On-Premise joined + Azure AD registered/joined + GPO to configure automatic registration MDM + ConfigMgr agent installed via ConfigMgr)
This option means that you simply connect your Windows , and 10 clients to your solution MDM using the GPO setting to enable automatic enrollment in MDM. The next step is to stop doing what you’re doing with GPO and ConfigMgr, and start doing it directly from your solution MDM. This is the least costly option when you’re trying to interfere as little as possible with the ConfigMgr solution and start moving away from ConfigMgr right away.
This option is more suitable for smaller and rather simple ConfigMgr environments.
Option 3: Hybrid attachments (with co-management in ConfigMgr enabled)
(Active Directory On-Premise joined + Azure AD registered / joined + co-management activated in ConfigMgr + ConfigMgr Agent installed via ConfigMgr)
We assume that, based on Microsoft's description, this is the real “co-management” .
This is the recommended approach for most organizations looking to get started with Modern Management.
Option 4: Computers joined to the cloud (with co-management enabled in ConfigMgr)
(Azure AD joined + MDM joined + ConfigMgr agent deployed via Intune)
This option is appealing, but since the devices are not connected to a Active Directory , you must have migrated all GPO and successfully provided users with access to all local resources when they are outside the corporate network.
This option is more for future use, although it may already be suitable for some customers.
Note: Even if devices are not connected to Active Directory On-Premise, they can use single sign-on to access resources on the internal network, such as printers, network shares, and other domain resources Active Directory. This is true as long as the device is on an internal network and is in contact with an on-premises domain controller, with a TGT- Kerberos d to access on-premises resources.
What an article Can't Know
An article describes what applies to everyone. What varies from one organization to another is the inventory: which applications, which accounts, and which pieces of equipment are actually involved in your organization. The inventory determines the scope of the effort, and it cannot be summarized on a single page.
You'll be speaking directly with the engineers who will be doing the work, not with a middleman. We'll respond within 24 business hours.
Check what is still true
Announced dates are sometimes postponed, products are renamed, and conditions change. The blog tracks these topics over time: when a rule changes, a new post announces it.
Search for a topic in the blogIn the same issue
Three articles on the same topic. The blog has 133 articles, all of which are freely available.