In a hybrid organization, the same workstation can be managed by two radically different mechanisms: the historical Group Policy from Active Directory, or the configuration profiles from Microsoft Intune. This article is intended for system administrators who still manage machines joined to Active Directory while progressively migrating to Entra ID and Intune, and who wonder how to configure, compare, and especially make these two worlds coexist.
Group Policy and Intune: Two Administration Logics
Group Policy is the native mechanism of Windows Server for managing machines joined to an Active Directory domain. Settings are pushed via the corporate network or a VPN, and they apply at restart or during periodic refresh.
Microsoft Intune, conversely, operates exclusively over the Internet: workstations require no connection to the internal network to receive their policies. Intune configuration profiles are also more functionally rich: they integrate natively with Conditional Access and can coexist with Group Policy in a co-management scenario, often controlled via a third-party dashboard offering a unified view.
The question is therefore not only "which one to choose", but "who has authority" over each workstation at any given time.
Who has Authority over the Workstation: AD, Entra ID, or Hybrid?
When a workstation is joined to Active Directory and synchronized via Microsoft Entra Connect (formerly Azure AD Connect), it appears in Entra ID with a hybrid status. As long as it remains in this state, it is Active Directory that retains configuration authority, and therefore Group Policy that remains the active mechanism — even if the user is visible and sometimes licensed in the Microsoft 365 tenant.
This point is often a source of confusion: a synchronized and Microsoft 365-licensed user is not automatically managed by Intune. The device itself must switch to Intune enrollment (via auto-enrollment, or transition to native Entra ID join) for Intune configuration profiles to take over.
Good to Know
In the Entra ID portal (Identity > Devices > All devices), the "Join type" column distinguishes Hybrid Azure AD joined workstations, Azure AD joined (native), and Azure AD registered. Only the latter two types can be managed 100% by Intune without Group Policy.
Configuring a Workstation via Group Policy: Step-by-Step Demonstration
To illustrate the mechanism, let's take a hybrid workstation placed in an organizational unit (OU) "Seattle Clients" with no policy applied by default, except for the default domain policy inherited in cascade.
Create the Group Policy Object (GPO)
In Server Manager > Group Policy Management, right-click on your domain or target OU, then choose "Create a GPO in this domain, and Link it here". Name it clearly (for example Seattle GPO): at this point, it is an empty template with no settings applied.
Edit Settings in Computer Configuration or User Configuration
Settings placed in Computer Configuration apply to any user logging into this machine, while User Configuration follows the user regardless of the workstation. Policies are permanent and non-modifiable by the user; Preferences are reapplied at each session but can be temporarily modified in between (typical case: printers).
Apply Concrete Restrictions
In Administrative Templates > Start Menu and Taskbar, you can force full-screen Start menu display, disable context menu, remove recently added programs, or prevent recent documents history. In Control Panel > Personalization, you can lock the lock screen image or disable the camera on that screen.
Force Policy Application
On the client workstation, open a command prompt or PowerShell as administrator and launch immediate policy update:
1gpupdate /forceA restart or a new user session is then necessary to visually validate the application of settings (Start menu forced to full screen, gaming options hidden in settings, etc.).
Switching to Intune Configuration Profiles
On the Intune side, the equivalent of GPOs is called configuration profile (Configuration Profile), available in Devices > Configuration of the Microsoft Intune admin center. Two conditions are essential: the workstation must be enrolled in Intune (via auto-enrollment configured in Entra ID, or native Entra ID join), and the user must have a valid Intune license.
Profiles come in several formats:
- Preconfigured templates (for example "Device restrictions"), which group dozens of thematic settings.
- Settings catalog, which allows you to compose a profile setting by setting, with granularity close to that of GPOs.
- Import of existing configuration files (custom ADMX, for example).
A Device restrictions type profile covers notably: blocking storage of business data on a personal Microsoft account, hiding the Settings app, restricting access to network or time settings, and of course disabling gaming features.
Create the Profile
In Devices > Windows > Configuration profiles > Create, select the platform "Windows 10 and later" and profile type "Templates > Device restrictions", then name your profile.
Select Settings
Browse through the categories (Cloud and storage, Control panel, Gaming, etc.) and enable relevant restrictions for your business context.
Assign the Profile
In the "Assignments" step, target a security group (never "All devices" without prior thought) and define, if needed, exclusion groups.
Tenant-Wide Impact
Assigning a configuration profile to the "All devices" or "All users" group applies the policy to the entire infrastructure within minutes, with no possibility of instant rollback. Always test first on a restricted pilot group before a wide assignment.
Once the profile is pushed, propagation generally takes a few minutes at the next Intune client synchronization (or can be forced manually via Settings > Accounts > Work or school access > Sync). You can verify effective application in Devices > Configuration profiles > [your profile] > Device status, which displays the status "Succeeded", "Error", or "Conflict" per machine.
Migrating Existing GPOs with Group Policy Analytics
Rather than manually recreating each setting, Microsoft offers Group Policy Analytics, a tool integrated into the Intune admin center that analyzes an exported GPO report and calculates the percentage of settings convertible to Intune profiles.
Export the GPO Report in XML Format
In Group Policy Management, select the target OU or GPO, right-click then Save Report. Imperatively choose the XML format (not HTML) before saving.
Import the Report into Intune
In the Microsoft Intune admin center, go to Devices > Group Policy analytics > Import, then select the XML file exported in the previous step.
Analyze Compatibility Rate
The tool displays a percentage of supported settings (in the demonstration example, approximately 80%). Non-convertible settings generally concern features specific to Active Directory with no direct equivalent on the Intune side.
Migrate to an Intune Profile
Select compatible settings, click Migrate, name the new profile, then assign it like any other configuration profile.
Tip
Always keep the source GPO active until the new Intune profile has been validated on a pilot group for at least one complete synchronization cycle. This prevents service disruption if a migrated setting behaves differently on the Intune side (the behavior of CSP Policies is not always identical to ADMX).
Group Policy vs Intune: Comparison Table
| Criteria | Group Policy | Microsoft Intune |
|---|---|---|
| Required Connectivity | Corporate Network or VPN | Internet Only |
| Type of Join | Active Directory / Hybrid Azure AD | Entra ID Joined or Registered |
| Required License | None (Windows Server Feature) | Intune License or Microsoft 365 including Intune |
| Conditional Access Integration | Not Native | Native |
| Settings Granularity | Very High (ADMX, 20 Years of History) | High and Growing (Settings Catalog) |
| Propagation Delay | Refresh Cycle or 'gpupdate /force' | Periodic Intune Client Synchronization |
| Migration Tool | — | Group Policy Analytics |
Implementation: Audit Your Profiles Before Migration
Before launching a GPO migration campaign to Intune, it is useful to have an up-to-date inventory of configuration profiles already in place and Group Policy Analytics migration reports already imported. The following script uses the Microsoft.Graph.DeviceManagement module in read-only mode.
- Required Module:
Microsoft.Graph.DeviceManagement(installation:Install-Module Microsoft.Graph.DeviceManagement -Scope CurrentUser) - Minimum Permission:
DeviceManagementConfiguration.Read.All(read-only, no write) - Output Produced: a CSV file listing existing configuration profiles, and a console display of Group Policy Analytics migration reports already imported
1# Connection with read-only scope (principle of least privilege)2Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"3 4# 1. Retrieval of Group Policy Analytics reports already imported (beta API)5$migrationReports = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyMigrationReports"6 7# 2. Retrieval of all existing Intune configuration profiles8$configProfiles = Get-MgDeviceManagementDeviceConfiguration -All9 10# 3. CSV export for review before any migration or cleanup operation11$dateExport = Get-Date -Format 'yyyyMMdd'12$configProfiles | Select-Object Id, DisplayName, LastModifiedDateTime |13 Export-Csv -Path "./IntuneConfigProfiles_$dateExport.csv" -NoTypeInformation -Encoding UTF814 15# 4. Synthetic display of GPO migration reports already present in the tenant16$migrationReports.value | Select-Object groupPolicyObjectName, ouDistinguishedName |17 Format-Table -AutoSize18 19Write-Host "Export completed: $($configProfiles.Count) Intune configuration profiles identified." -ForegroundColor GreenThis script changes nothing: it produces an inventory that can be used to plan pilot groups and detect any duplicate profiles before starting a large-scale Group Policy Analytics migration.
Troubleshooting: Common Errors During Migration
- The workstation does not appear in "All devices" in Entra ID after login: device synchronization can take several minutes after the first session; check enrollment status via
dsregcmd /statuslocally on the workstation. - A synchronized user is not managed by Intune: verify that a license including Intune is indeed assigned to them in the Microsoft 365 admin center, and that the device has actually switched out of purely hybrid mode if you are targeting native Intune management.
- Group Policy Analytics displays a low compatibility percentage: open the detail of unsupported settings — this is most often custom ADMX settings or features related to server roles with no equivalent CSP (Configuration Service Provider) on the modern Windows side.
- A migrated profile does not apply: check the status in Device status of the profile; a conflict with another configuration profile or with a remaining GPO still active on the same workstation (poorly configured co-management mode) is the most frequent cause.
Key Points to Remember
- Group Policy retains authority over any workstation as long as it remains in hybrid mode under Active Directory, even if the user is licensed for Microsoft 365.
- Intune requires device enrollment and a dedicated license to take over with its configuration profiles.
- Group Policy Analytics allows you to estimate and automate much of the conversion of existing GPOs, but never covers 100% of settings.
- Test any large Intune profile assignment on a restricted pilot group before a tenant-wide deployment.
If your organization plans to gradually abandon Active Directory, start by exporting your critical GPOs to XML and launch a first Group Policy Analytics analysis this week: it is the quickest way to concretely measure the gap between your current foundation and what Intune can really take over.
