The co-management Also known as joint management: a single position managed simultaneously by Configuration Manager (SCCM) and Intune.
Activation is as simple as checking a box. It’s the four conditions mentioned earlier that make up the project.That’s the good news about this topic, and it’s rarely mentioned: enabling joint management requires neither migration, a reinstallation, or any service interruption. Nothing changes for your users on the day it’s enabled. The real work happens upstream—there are four conditions that must be met, one of which blocks half of the projects that start without having verified it.
What You Need to Gather
Four conditions—and the third one surprises everyone.
These aren't recommendations: they are four prerequisites published by Microsoft, and if even one of them is missing, the checkbox will have no effect. It takes half a day to verify all four, and that's exactly what we do before proposing anything.
A formal version of Configuration Manager
Joint management requires a version of the current branch that is still supported. Each version is supported for eighteen months, and many sites are running on a version that is no longer supported.
This is the easiest condition to correct, and the one most often to blame.
A directory level that allows for automatic enrollment
You need a paid level ofEntra ID , plus a license Intune assigned to the administrator account itself—otherwise, the console will refuse the connection with a message that gives no explanation.
Most business subscriptions already include it.
Devices listed in the directory, not just registered
A phone must be enrolled in the directory or enrolled in hybrid mode. A device that is merely registered —the state that occurs when a user adds their work account to a personal device— is not supported.
This is the condition that halts a Net project, and it isn't visible in the management console.
Automatic registration enabled in the tenant
On the Intune, automatic device registration Windows must be enabled and its scope defined: all users, or a group. Until this is done, the devices remain invisible on the cloud.
One adjustment, two minutes—but you have to know it's there.
A reassuring clarification—and it’s true: the management gateway in the cloud is not a prerequisite. It’s often confused with joint management because both are used to “go beyond the network,” but it’s only necessary if your workstations need to connect to the web server from the Internet. Many school districts get by just fine without it in the first year.
Where to Enter
Two paths—and they're not alike.
The path depends on what you already have, not on what you want to achieve: both lead to the same place. Most Swiss parks take the first path, because they have a Configuration Manager system that’s been running for ten years and equipment that it would be absurd to reinstall.
You start from a park Configuration Manager
Your workstations already support the client; they're already set up for it, and you want to add the cloud without having to take anything apart.
- 01We’re switching the site to a supported version, if it isn’t already
- 02We are connecting the domain to the directory so that the extensions can be linked in hybrid mode
- 03Enable automatic enrollment in the tenant
- 04Enable joint management in the console on a test collection
- 05The posts are part of Intune automatically, without any action on the user’s part
You'll start from a position prepared by Autopilot
The machine comes out of the box, sets itself up, joins the directory, and registers with Intune. All it needs now is the local client.
- 01The position is included with the directory and listed in Intune
- 02We're installing the client for him Configuration Manager, just like any other application
- 03It becomes co-managed at the first lift
- 04If the workstation never connects to the office network, it needs a management gateway on the cloud to access the site
Both approaches can coexist, and this is actually the typical scenario for a park that is undergoing renewal: older stations come in through the first approach, new ones through the second, and they all end up in the same dashboard. A single site— Configuration Manager —can also be connected to a single tenant, and multiple sites can be connected to the same tenant —which is useful after an acquisition.
To attach is not the same as to manage.
This is the most common source of confusion in this entire topic, and Microsoft itself writes that its customers make this mistake. It wastes weeks: you think you have a co-management issue when you actually have an identity issue, and you end up looking for the problem in the wrong place.
The junction identifies which machine it is
It's a directory issue. A device can be connected to the directory alone, connected in hybrid mode—local directory plus online directory—or simply registered by a user who has added their work account.
Management says who gives it orders
It's a matter of the right tool. Configuration Manager, Intune, or both. A machine can be fully managed by a single person: this is the case for all the entries found in the directory that we’ve never seen in a console.
Only the saved state closes the door
Both connections allow for joint management. A simple, one-time registration—and once it’s set up, there’s no going back: you have to remove the device fromIntune and the directory, then add it back. That’s why it’s important to know this beforehand, not in the middle of the process.
That’s why our first deliverable isn’t a project plan: it’s the connection status of your fleet, machine by machine. How many are connected, how many are connected in hybrid mode, how many are only registered, and how many are in the directory without being managed by anyone. In the fleets we take over, that last column is always a surprise.
Before changing anything
Six things happen on the same day.
This is the least well-known aspect of the topic—and the biggest selling point: these six gains require no adjustment. They occur the moment joint control kicks in, even as Configuration Manager the system continues to control everything exactly as it did the day before.
Conditional access ultimately depends on the status of the terminals
A non-compliant message may be rejected at the gateway for email and files. This is the first benefit that management sees, and the only one on this list that actually prevents anything from happening.
Remote actions from the online console
Restart, sync, rename, or reset a workstation—including preserving its registration and user account. From anywhere, without a private network.
The health status of the local client, as seen from Intune
The joint management dashboard shows which workstations are actually being managed. This is often the first time a company sees the discrepancy between its number of licenses and its number of workstations that are actually being managed.
Autopilot 's preparation is now possible
A workstation can now be delivered directly to the user, set up on its own, and become co-managed without going through your workshop. This is what makes the biggest difference in the lives of the teams receiving the equipment.
Users, devices, and applications in the same directory
Knowing which user is working on which machine—and with which applications—without having to manually cross-reference two export files. That’s the foundation for everything that follows.
Nothing is irreversible, and this can be measured
Joint management turns off just as easily as it turns on. Each settings area that is toggled can then be reverted with a single action. This is what makes it possible to get started without having to decide everything.
Each switch is first tested on a test collection
Only then do we move on to the configuration switches, one area at a time. And each one can be limited to a select set—chosen in consultation with you—before being extended to the entire fleet. That’s the only honest way to find out what breaks: on your machines, with your software, and not just in a demo.
Seven settings can thus be switched to Intune. The order in which to address them is not a matter of preference; it is a ranking of risk—and it is described in detail at the page Configuration Manager .
Your new workstations? They can be co-managed without going through your workshop.
The machine leaves the supplier, the user unpacks it at home, it sets itself up, and immediately begins serving the local customer. This is whatAutopilot does, and this is the standard process for everything you buy from now on.
Our Approach
The half-day audit takes precedence over everything else.
Four steps—and sometimes the first one is enough to answer your question: Sometimes a park is already set up, and it takes an hour to turn on the lights. We’ll let you know if that’s the case for you, rather than dragging out a project that isn’t really one.
The connection status of the fleet, machine by machine
How many extensions are listed in the directory, how many are listed in hybrid mode, how many are only registered, and how many appear in the directory without being managed by anyone.
We check all four conditions at the same time: site version, directory level, automatic registration, and administration account license.
The missing conditions, one by one
Update the site as needed, connect the domain to the directory, enable automatic enrollment, and migrate the user accounts that were previously only registered.
None of this interrupts service, and none of it is visible to your users: this is the quietest part of the project.
Ignition, on a test set
Joint management is enabled for a group selected in consultation with you—an entire department rather than three lab computers. The workstations register automatically, and we review the data that comes in.
This is the step that determines what happens next: we measure the actual enrollment rate, and we address the areas that are lagging behind before expanding.
The Expansion into the Park, and What Followed
We roll it out in waves, each with its own criteria for stopping. From that point on, the question is no longer “should we co-manage?” but “which settings should we adjust, and when?” — and that question is addressed over time, without urgency.
Your teams need to be able to handle everything on their own without us. We provide training, we document the process, and we remain available to handle the parts you don't want to tackle yourselves.
What You Should Know Beforehand
Five points to consider, and everyone has their own answer.
None of them are deal-breakers. These are the five areas where a joint management project is falling behind, and each one can be resolved —provided it’s addressed before setting a date, rather than on the evening of the lighting ceremony.
Entries that have only been saved can be retrieved, but one at a time
A device that is simply listed in the directory cannot be co-managed, and this cannot be corrected on the spot: you must remove it fromIntune and the directory, then re-add it properly.
The answer is simple, and we do this all the time: we identify these items on the first day, process them in batches using a written procedure, and the user sees nothing more than a reconnection. What’s costly is discovering them during the switchover.
The hybrid approach remains popular, but it is no longer the recommended option
Microsoft now recommends deploying new devices joined to the directory alone, rather than in hybrid mode. Hybrid joining continues to work and remains supported; it is simply no longer the default choice for new hardware.
In practical terms, this doesn’t change anything for an existing fleet, which is good news: your current workstations will continue to be connected in hybrid mode without any issues. The question only arises for the machines you purchase, and we’re asking it at the right time—when you’re replacing equipment, not in the middle of the transition.
The directory connector has a minimum version; if the version is lower than that, it does nothing.
If you join your devices in hybrid mode via Autopilot, a connector is installed on a server. Versions prior to 6.2501.2000.5 no longer process any registration requests: deployments fail without a clear error message.
The fix is quick and risk-free: we install the updated connector on another server before removing the old one, which prevents any downtime. This is the first thing we check on a network that connects in hybrid mode.
The management gateway is billed monthly, as needed
It allows your workstations to be accessible from off-site locations without a private network. It is not a prerequisite for joint management, and it is not included: it consumes billed resources, such as computing power and outbound traffic.
We assess it before installing it, and we’ll let you know if an existing private network is sufficient —this happens more often than you might think. For a fleet that returns to the office from time to time, you can also wait until the second year.
Two consoles for a while—and that's normal
As long as not all configuration areas have been migrated—and there’s no requirement that they be—your teams are working in two consoles. This is the most common criticism leveled at joint management.
This is also the price of reversibility, and it is decreasing: the joint management dashboard brings together the essentials, and the division of responsibilities is defined once and for all, so that everyone knows where to look. We document this division: that’s what sets two consoles and two reflexes apart.
Frequently Asked Questions
What we're asked to do before we begin.
Six questions that come up on every first date.
Will our users notice anything?
On the day of startup, no. Joint management adds a background entry and does not change any settings: Configuration Manager it continues to control everything just as it did the day before. That’s what makes this step easy to plan.
This becomes apparent later, when a settings section changes to Intune — for example, updates to Windows, which then change their reboot window. Each transition is prepared with your input and is first tested on a trial group.
Do we need additional licenses?
No, in the sense that raises the most concern: a subscription that includes Intune also includes the right to use the Configuration Manager client. So you don't have to pay twice to keep both tools.
However, you need a paid directory plan that supports automatic registration and conditional access, plus a license Intune assigned to the admin account. Most enterprise subscriptions already include this; we check the billing statement to confirm, because this is not the case for all of them.
How long does it take?
Verifying the four conditions takes half a day. The ignition process itself takes one hour on a test set.
What takes time happens elsewhere, and it can be measured as soon as the survey is complete: updating the site if necessary, connecting the domain to the directory if it doesn’t already exist, and importing the entries that were previously only registered. We provide a date after the survey is complete, because a date given before that means nothing.
Can we go back?
Yes, and on two levels. Joint management itself turns off just as easily as it turns on. And each configuration area that is switched to Intune can be Configuration Manager a single action, without reinstalling anything.
We're trying out this procedure during the testing phase, before we actually need it. This is what allows us to move forward domain by domain without having to decide everything right from the start.
Our mail almost never makes it to the office. Does it still work?
As for Intune, yes: a registered device can be reached anywhere it has network coverage. On the Configuration Manager, the client must be able to communicate with its site: without a private network, this requires a management gateway in the cloud.
Two honest answers, depending on the situation. For a mixed fleet, the gateway is the right investment. For a fully mobile fleet, the question to ask is rather what value Configuration Manager still provides —and in that case, the answer might be “setting up new machines, and nothing else.”
How many domains do you need to migrate for it to be worth it?
Zero. That’s the most counterintuitive aspect of this topic: the six immediate benefits occur before any changes take effect, including conditional access. Many parks remain for years with joint management enabled and one or two domains moved.
Next, a domain is moved when it is better served elsewhere—not because a schedule for migration schedules it. The risk ranking and details for the seven domains are available on the page Configuration Manager.
About Joint Management
The four pages that complement each other.
This topic covers both tools and the identity that connects them. Each of these pages covers one aspect, without repeating the others.
Is there an acronym you don't understand? They're all explained in plain language in our glossary .
Let's start by looking at the connection status of your fleet
One hour with the engineers who will do the work, and both of your consoles up and running. We’ll let you know if all four conditions are met, what’s missing, and how many workstations need to be set up again— even if the answer is that everything is already ready.
Preparing the proposal is free; assessing the existing conditions is the first step in the project. We are happy to arrange a meeting with the engineers who will be doing the work. We have been authorized to provide staffing services since 2018: an engineer can also join your team for a fixed term.
How many of your entries are listed in the directory but aren't managed by anyone?
If you can provide the figure, your park is set: joint management will be a process, not a project.
If the answer is “we’d have to look into it, ” then that’s exactly where we need to start—and that’s not bad news: that column fills up quickly, and it often explains the discrepancy between the number of paid licenses and the number of workstations actually in use.