SCCM, today Configuration Manager SCCM, MECM, Configuration Manager : three names for the same product. You’ve come to the right place.
He's not dead. He's at the end of his rope.No end date has been announced, and the product still does things that no other tool cloud does. But two things have changed quietly: Microsoft has stated that new features will now be released in Intune, and each version is supported for only eighteen months. Many Swiss IT environments are currently running on a version that is already out of support, without anyone having noticed.
The Dates That Matter
Four deadlines—and you've already cleared the first one.
These aren't opinions: they are four dates published by Microsoft, and we are happy to cite them directly from the source. None of them can be purchased —there is no paid patch program for this product after a version's end of support. The only solution is to upgrade.
Version 2409 is no longer supported
No more patches, and no more phone or online support for this version. The support team will still help you upgrade, but that's all.
This is the most common version found in parks, which we are featuring here.
Version 2503 is also reaching the end of its support period
Eighteen months after it was made available, just like all the others. That’s the next deadline, and it’s the one that should be on this fall’s calendar.
A website upgrade can't be thrown together in the last week.
An internal compliance audit department is being eliminated
After this removal, the Software Center's compliance checks fail for the jointly managed fleets whose compliance is maintained by Intune.
The fix is available, and it's simple: install version 2603 before October.
The product will switch to one release per year
The release schedule used to be two versions per year. It is now annual, and cumulative updates are reserved for urgent security or operational issues.
Fewer new releases, but a slower pace of operations.
One detail that’s missing from almost all discussions on this topic: “End of Support” does not mean “discontinued.” A site in 2409 continues to operate, distribute software, and deploy systems. What it loses is the right to security patches and support—and those are precisely the two things you need when something breaks.
How are you doing?
The picture that no one shows you.
Your version is displayed in the console, in the upper-left corner, under “About” Configuration Manager. Look for it in this column: it tells you in a single line whether you have a project this fall. Each version is supported for eighteen months, without exception and with no possibility of extension.
| Version | Available since | End of Support | What This Means for You |
|---|---|---|---|
| 2609 | September 2026 | Coming Soon | The first installment of the annual cycle. Nothing to do today, except to know that it’s coming and that the rhythm changes with it. |
| 2603 | May 5, 2026 | November 5, 2027 | The most recent and longest-lasting version. This is the target we recommend, and the only one that protects against the October 2026 phase-out of compliance checks. |
| 2509 | November 12, 2025 | May 12, 2027 | Supported, and it's also the recommended version for setting up a new site. Convenient if you don't want to make the switch twice this year. |
| 2503 | March 31, 2025 | September 30, 2026 | Fall 2026 release. This is the last version for which support ends this year: after September 30, it will join the two lines below it. |
| 2409 | December 4, 2024 | June 4, 2026 | Not supported. Good news nonetheless: this is the minimum requirement for upgrading directly to 2603, so the upgrade can be done in a single step. |
| 2403 and earlier | April 2024 and earlier | Unbound | It's not supported natively, and there's no direct jump. You have to go through an intermediate version before reaching 2603. This is the scenario that requires real preparation. |
There are two points that this table does not mention but that are just as important. First, version 2603 introduces a new requirement: the management point must be able to connect to the Internet to validate identity tokens, which was not required before—a site isolated behind a strict proxy will have some work to do before upgrading. Second, it removes the dependency on a deprecated database component and supports SQL Server 2025: this is an opportunity to update the foundation all at once, rather than twice.
Why Is He Still Here?
Six things he does, and that cloud doesn't do.
This is the part of the discussion that’s often glossed over, because it doesn’t align with the prevailing narrative. Yet these six points are enough to justify keeping the product: if even one of them applies to you, the right answer isn’t to overhaul everything.
Install a system on a bare-metal machine
Network boot, task sequence, system image, model-specific drivers: setting up a workstation with a blank hard drive, or reinstalling forty of them in a row in a computer lab. No tool cloud does that: you need a system that’s already booted up.
Managing Devices That Never Connect to the Internet
Workshops, production lines, laboratories, and networks separated by regulatory requirements. A device managed within the cloud must contact the service regularly; these machines will never do so, and this is not a configuration error.
Maintain the servers Windows—not just workstations
Patches, inventory, compliance, software distribution on servers: this is a field that Configuration Manager has been in place for twenty years and one that modern workstation management has never claimed to address.
Deliver large packages without overloading the line
Local distribution points, sharing between neighboring workstations, time slots, and bandwidth limits. On a site connected by a low-bandwidth line, downloading software that’s several gigabytes in size from the Internet to 100 workstations is not the same process.
Knowing exactly what is installed and where
Detailed hardware and software inventory, software usage metrics, and unrestricted queries on the database. Whether for hardware replacement, license negotiations, or an audit, this level of detail remains unmatched.
Carefully manage updates, including third-party updates
Bundling, due dates, exclusions, third-party publisher patches published by your own update server. Whereas a service in the cloud offers rings, the local tool offers a control room.
What Configuration Manager does not cover, however, are phones, tablets, Macs, devices that are never brought into the office, and personal devices. Local mobile management was removed from the product a long time ago, and it won’t be coming back.
It co-management is not a stage. It is the normal state.
It’s presented to you as a transitional phase that you need to get through as quickly as possible to reach “the cloud .” This is a misinterpretation, and it comes at a high cost: it leads to dismantling a tool that is still useful, and to promising a shutdown date that no one can meet.
Each domain switches over on its own and returns on its own
Seven configuration areas, seven independent decisions. There’s no requirement to switch them all, and each setting can be undone with a single action. A fleet can remain for years with three areas set to cloud and four locally: this is a supported configuration, not a makeshift solution.
A switch is controlled on a test group
Each domain can be switched over to a limited collection before rolling it out to the entire infrastructure. This is the only reliable way to find out what breaks: on your machines, with your software, and not in a demo.
The local client license is already included
A subscription that includes Intune also includes the right to use the Configuration Manager client. So keeping both doesn’t cost twice as much—the financial argument that “you have to choose” doesn’t hold water.
Our position—and we maintain this before you just as we do before the publisher—is that we shift a workload when it is better served elsewhere, never simply because a migration schedule calls for it. What remains within your walls stays there for a documented reason, which you will be able to review in two years.
Attention to detail and order
Seven areas, and the order in which to address them.
Here are the seven areas of configuration that joint management allows us to delegate to Intune, in the order in which we apply them to an operational fleet. The order is not a matter of preference—it’s a risk-based sequence. The first three almost never cause any issues. The last two require thorough preparation.
Compliance Rules
Device health: encryption, operating system version, antivirus, password. This is the area that does not install or modify anything.
First of all, why? This domain merely records data. Toggling it doesn't change anything for the user, and it is the user who unlocks conditional access—which is the first visible benefit for management.
Strategies for Accessing Resources
Wireless network, private network, certificate, and email profiles. The information the device needs to connect to company resources.
First of all: the scope is small, the effect is immediate, and this is the area that makes a laptop usable without ever having to go back to the office. Be careful with certificates: that’s where everything comes down to.
Protecting the Device
The built-in antivirus, firewall, disk encryption, and rules for reducing the attack surface.
First of all: the settings are well covered on both sides, and security is best managed wherever the device can be reached—that is, within cloud for a mobile fleet.
Updates to Windows
Deployment phases, timelines, deadlines, and restart windows.
Why next: The benefit is clear for mobile workstations, but control becomes less precise than with the local tool. For a fleet operating under strict scheduling constraints, this system deserves to remain in place for a longer period of time.
Office Applications
Installing and updating the subscription-based office suite.
Why next: It’s technically simple, but first you need to make sure that no business logic depends on a fixed version. This is the most common cause of incidents in this area.
Device Configuration
All other system settings: interface, restrictions, printers, regional options, and the equivalent of your Group Policy settings.
Why proceed with caution: this is the broadest and least symmetrical domain. Some of your current settings have no direct equivalent, and others are no longer useful: you need to sort them out before translating, not the other way around.
Business Applications
Your own software: the kind with a local database, one license per workstation, and an installation script written twelve years ago.
Why with caution: this is where the actual workload of the project lies. Each application is repackaged and retested. We price this area on a per-application basis, never as a flat rate.
What does not change—and therefore remains the responsibility of the local entity in all cases— is system deployment, detailed inventory, server management, and distribution points. These are not areas of joint management; they are functions that exist on only one side.
Your cell phones? That's Intune, and you’ve probably already paid for it.
Phones, tablets, Macs, devices from third-party providers, and workstations that never make it back to the office: that’s the realm of the cloud, and the license is included in most Microsoft 365 for business subscriptions. We handle both, with the same engineers.
Our Approach
First, back up the site. Then everything else.
Five steps, always in this order. The first one isn't just a formality: a website Configuration Manager whose backup has never actually been restored is a site without a backup. We check this before making any changes to a version, not after.
The condition of the site and the trial restoration
Exact version, roles in place, database status, hierarchy, distribution points, service accounts, and the actual percentage of customers who log in—the one shown on the console, not the one we hope for.
Then there's the backup: we restore it elsewhere to make sure it's actually useful. That's the only proof that matters.
Refurbishment, including the base
A move toward a more rigorous version, in one or two steps depending on the starting point. The prerequisite checker runs first, and it rejects more things than before: that’s good news.
We handle everything that needed to be addressed anyway within the same project: the server's operating system, the database version, and the deprecated components that need to be removed.
Identity authentication and external access
The site is connected to the directory so that devices and users are recognized on both sides. If your extensions need to be reachable off-site, the management gateway in this cloud is where this comes into play.
We calculate its operating costs before installing it: it consumes resources that are billed monthly, and this is known in advance.
Joint management, one area at a time
We enable joint management, then move the domains in order of risk, each first to a test collection selected in consultation with you.
This is the step that determines what happens next. If a domain turns out to be better served where it is, it stays there—and that is noted in the report, along with the reason.
Exploitation, and what remains after we're gone
One release per year starting in 2609—that’s an annual event to mark on your calendar. We document the procedure, train your teams, and remain available to handle the parts you don’t want to tackle yourselves.
We also handle communications with the publisher's support team when the issue is on their end: it's a job in its own right.
What You Should Know Beforehand
Six pitfalls that can throw off a schedule.
None of them is insurmountable. But each one has already cost someone a week, and all of them should be verified before setting a date, rather than on the evening of the upgrade.
Starting with version 2603, the management point requires an Internet connection
This is a new requirement, and it comes as a surprise: to validate identity tokens, the server serving this role must include two authentication addresses from the issuer. Previously, it could operate without any outbound access.
Two details that can ruin an evening: the proxy must be specified in the context of the system account, and the one configured in the site server properties is not used for this verification. A site behind strict proxy therefore prepares for opening before the upgrade, not during it.
You should only skip one step at a time
Version 2603 can be installed on a site that is already running version 2409 or later. Starting with version 2403 or earlier, you must go through an intermediate version: two maintenance windows instead of one, and two runs of the prerequisite checker.
That is why a website that has gone two years without an update costs more to bring up to date than one that has been maintained. The backlog does not accumulate linearly; it builds up in stages.
The October 2026 withdrawal silently breaks a control
An internal compliance verification service will be discontinued in October 2026. After this discontinuation, for a jointly managed fleet whose compliance is maintained by Intune, the checks initiated from the Software Center fail.
Nothing stops abruptly: the user sees an error, while the administrator sees a counter that’s decreasing. The fix is to install version 2603 before October 2026, and there is no other solution.
The management gateway is cloud is billed monthly
It’s what makes your workstations accessible from off-site without a private network. It’s very useful, but it’s often misunderstood: it consumes billed resources, including processing power and outbound traffic.
The cost depends on the number of connected workstations and the volume of data transmitted. We estimate the cost before installing the network, and we let you know when an existing private network is sufficient—which happens more often than you might think.
Changing servers is not a copy
This is a common scenario: the site is running on an outdated server, and we want to migrate it to a newer system. This isn't done by simply copying files; it's a site restoration, using the same server name and the same database.
A site that has been restored under a different name cannot be repaired: it must be completely rebuilt, and the history, collections, and task sequences are lost. This is the operation where we place the greatest emphasis on dry runs.
A link to the directory is not the same as joint management
These are two different issues, and this is the most common source of confusion: the first is a matter of identity, the second a matter of management. One can exist without the other.
One specific issue that is holding up projects: a device that is only listed in the directory cannot be under joint management. It must be linked or linked in hybrid mode. This check is performed during the initial inventory, because it changes the plan.
Frequently Asked Questions
What we're asked to do before we begin.
Seven questions that come up on every first date, and the first one is always the same.
Configuration Manager Will it stop?
No end date has been announced, and the product continues to receive releases that are supported for eighteen months each. What has changed is the pace and the scope: one release per year starting in September 2026, and a clear statement from the publisher that new features will be introduced Intune while Configuration Manager focuses on security, stability, and support for the installed base.
In practical terms, for those using the product: don’t expect any more spectacular new features, but don’t plan to phase it out just yet either. Plan for one upgrade per year, and migrate workloads as and when they’re better served elsewhere.
Should we migrate to Intune ?
For laptops, cell phones, Macs, and anything else that doesn't fit in the office: yes, and it's already included in most Microsoft 365 for Business subscriptions. For machines that need to be reinstalled over the network, closed networks, and servers: no.
So the relevant question is never “which of the two” but “what workload, and when.” The Microsoft page Intune covers the other half of the topic.
Our website runs on an old server and an old database. What should we do?
Both are handled as part of the same project as the version upgrade, and that’s what costs the least: a single service outage instead of three. Recent versions support SQL Server 2025 and remove the dependency on an older data access component.
Watch out for this pitfall when moving a site: moving a site to a new server is a restore, not a copy, and the server name must be kept the same. This is the process that we always test with a dry run before performing it for real.
Can we manage our remote work positions with Configuration Manager ?
Yes, using the management gateway in the cloud : the client communicates with the site through a service exposed on the Internet, without a private network. It works well, and many of our customers use it.
Two fair caveats. The gateway is billed monthly, based on usage. And for a workstation that is never returned, management cloud remains simpler and less expensive. The gateway is designed for mixed fleets, not entirely nomadic ones.
Should we keep our update server?
Yes: the software update hub relies on it, and it continues to function. Microsoft announced in 2024 that it would no longer add features to this component, but would continue to support it and release updates through this channel.
In other words: there’s no urgent action needed, and nothing new to expect. No end date has been announced, and the announced write-down does not diminish the current capabilities of Configuration Manager.
Does joint management require additional licenses?
No, in the sense that raises the most concern: a subscription that includes Intune also includes the right to use the Configuration Manager client. So you don't have to pay twice to keep both tools.
However, a directory level is required that allows for automatic registration and conditional access. Most corporate subscriptions already include this; we verify it when reviewing the subscription details, because this is not the case for all of them.
How long does an upgrade take?
The site upgrade itself fits within a maintenance window: it is installed from the console and runs automatically. The time-consuming part is elsewhere.
These are the prerequisites that need to be addressed, the gradual migration of clients after the upgrade, and the use of an intermediate version when the starting point is too old. We only provide a date after the site profile is complete, because a date given before that means nothing .
Around the Park
What a project Configuration Manager always touches.
No fleet management project stops at the site server. These issues all come up sooner or later.
Is there an acronym you don't understand? They're all explained in plain language in our glossary .
Let's start with the version of your website
An hour with the engineers who will be doing the work, and your console open. We’ll let you know where you stand in the release schedule, what needs to be done before fall, and what can wait— including when the answer is not to change anything this year.
Preparing a quote is free; the site profile is the first step in the project. We are happy to arrange a meeting with the engineers who will be doing the work. We have been licensed to provide staffing services since 2018: an engineer can also join your team for a fixed term.
Which version is running on your site, and how long will it be supported?
If you can answer both questions from memory, your fleet is well-managed: the annual upgrade will be a routine event, not a major project.
If the answer is “we’d have to check, ” then there’s a good chance that the first date has already passed. You can verify this in thirty seconds in the console, and that’s where we’ll start.