GPO management with Intune in hybrid environments

What GPO management with Intune actually means

Intune does not manage Group Policy Objects (GPO) directly. It has no GPO editor, no OU structure, and no GPMC equivalent. When IT admins refer to GPO management with Intune, they usually mean one of two things: Migrating existing on-premises GPO settings into equivalent Intune policies, or running both GPO and Intune in parallel on hybrid-joined devices and understanding how the two systems interact.

The two tools use different mechanisms to enforce settings. Group Policy applies policies to domain-joined Windows devices through AD, while Intune uses Configuration Service Providers (CSPs), a structured layer that connects the MDM platform to Windows settings, and applies policies over HTTPS regardless of network location.

Sometimes GPO and Intune can target similar settings, leading to conflict between the two systems on hybrid-joined devices. Understanding how coexistence, migration, and overlap work in practice is the core of GPO management with Intune.

How Group Policy and Intune differ

The targeting model is where the operational difference is often most visible. GPO targets by OU membership and security group filtering, both defined in AD. Intune targets by Microsoft Entra ID group membership, which may or may not reflect your AD OU structure. In a hybrid environment, the two targeting models run in parallel and can produce different effective policies on the same device.

Does Intune replace Group Policy?

For most organizations, not completely. Microsoft continues to expand Intune through Group Policy Analytics, Settings Catalog, and broader CSP coverage, but the practical answer still depends on your environment.

For cloud-native or Microsoft Entra ID-joined devices, domain-based GPO does not apply. Intune, through Settings Catalog and Administrative Templates, becomes the primary configuration platform.

For hybrid-joined devices connected to both AD and Microsoft Entra ID, both GPO and Intune can apply settings at the same time. Many organizations in this state use GPO for settings that have no practical Intune equivalent and Intune for cloud-native scenarios such as conditional access, app protection, and remote policy delivery.

For domain-joined-only devices that are not enrolled in Intune, Group Policy remains the only option. Devices that cannot be enrolled cannot be managed through Intune.

The practical answer for many mid-sized domain environments today is this: GPO continues to manage much of the on-premises settings estate, while Intune handles cloud-based, remote, and mobile scenarios. In most environments, migration is gradual rather than a full cutover.

Migrating GPOs to Intune using Group Policy Analytics

Group Policy Analytics is a feature in the Microsoft Intune admin center that reads exported GPO XML files, maps each setting to an Intune equivalent where one exists, and shows an MDM support percentage indicating how much of the GPO can be recreated natively in Intune. Settings that are supported can be migrated to a Settings Catalog policy. Settings without an equivalent usually require a different approach.

Handling settings that cannot be migrated

For settings with no Intune equivalent, you generally have three options:

• Keep the GPO active for those settings on domain-joined machines. Running a partial GPO alongside Intune for settings that Intune cannot cover is common. Review retained GPO settings carefully to avoid overlap with Intune-managed settings.
• Create a custom OMA-URI profile for settings that exist in the Windows CSP model but were not detected by Group Policy Analytics. Go to Devices > Configuration profiles > Create > Windows 10 and later > Custom and enter the OMA-URI path manually. The Windows CSP reference documents available URIs.
• Remove the setting if it only supports on-premises infrastructure that does not apply to Intune-managed endpoints. For example, drive mapping GPOs tied to file servers may no longer be relevant for users working primarily in SharePoint or OneDrive.

How GPO and Intune conflicts work

On hybrid-joined devices that receive both GPO and Intune policies, conflicts can happen when both systems attempt to manage the same setting.

In general, when equivalent settings are managed through supported MDM policy channels, Windows often prioritizes the MDM-managed policy over the equivalent GPO setting. However, behavior can vary depending on the setting type, CSP, and deployment method. Due to this, the safest approach is to validate overlaps during testing rather than assume the same precedence behavior for every setting.

Not all Intune settings behave the same way. Settings delivered through the Policy CSP may behave differently from settings delivered through compliance policies, endpoint security profiles, or other configuration channels. In some cases, GPO and Intune settings can coexist without conflict because they control different parts of the system.

The safest approach in a hybrid environment is to use Group Policy Analytics to identify overlapping settings before assigning Intune policies, then retire, narrow, or re-scope the corresponding GPO once the Intune policy is confirmed to be working as expected.

Identifying and resolving conflicts on a specific device

To see which GPOs are applying to a device, run the following command on the target machine:

This shows which GPOs are in the applied list.

To review Intune-applied settings, go to Devices > [device name] > Device configuration in the Intune admin center. Each profile shows its assignment status and whether it applied successfully.

For a broader view of effective Group Policy results, run:

Open the HTML report and review the Computer Configuration section. Use this report together with the Intune admin center to compare what is being applied from each management plane.

Intune policy types that replace GPO functionality

Once settings are migrated, Intune typically uses three profile types to enforce configuration:

• Settings Catalog is the primary replacement for many ADMX-based GPO settings. It provides a browsable library of Windows settings organized by category and is often the output of the Group Policy Analytics migration workflow.
• Administrative Templates in Intune are prebuilt ADMX-based templates covering Microsoft Edge, Microsoft Office, OneDrive, and a subset of Windows settings. These mirror the Administrative Templates experience in GPMC for common scenarios.
• Custom OMA-URI profiles map directly to Windows CSP paths. They are used for settings that exist in the Windows CSP model but are not yet exposed in the Settings Catalog UI.

When to keep using Group Policy

Intune does not yet cover every scenario that GPO handles, and some environments are not suitable for Intune enrollment. Group Policy remains the right tool in the following situations:

• On-premises-only devices that cannot be enrolled in Intune, such as air-gapped systems, legacy hardware, or machines in environments without the required cloud management setup, continue to be managed through GPO.
• Settings with no CSP equivalent that are not covered by the Settings Catalog or an available OMA-URI remain GPO candidates. This can include specialized ADMX policies for third-party software, legacy Windows components, and infrastructure-specific configurations.
• Drive mappings, logon scripts, and printer deployments that depend on on-premises infrastructure are still better suited to GPO. Intune does not provide a direct equivalent to GPO Preferences for every one of these scenarios.

Environments not licensed or prepared for Intune may also continue using GPO longer. Check current Microsoft licensing and enrollment prerequisites before planning a migration strategy.

Managing on-premises GPOs at scale with ADManager Plus

Migrating settings to Intune is usually a gradual process, and many environments continue running on-premises GPOs for settings that Intune does not yet cover. If you still need to manage on-premises GPOs during that transition, ADManager Plus can help simplify the operational side of that work.

• Bulk GPO linking: Link GPOs to multiple OUs at the same time from a web console instead of repeating each link manually in GPMC.
• Link order management: Adjust GPO precedence from the web UI as your OU structure and policy scope change during migration.
• On-demand policy refresh: Trigger immediate GPO updates on selected computers without logging in to each machine individually.
• Application visibility: Run reports to see which policies are linked to which OUs, identify unlinked or empty GPOs, and review GPO usage before and after migration.
• Delegation oversight: Delegate GPO-related tasks to technicians through role-based access without requiring Domain Admin rights or local RSAT installation.
• GPO migration across domains: Copy GPOs including their configurations and access control lists from one AD domain or forest to another, helping you standardize GPO configurations before deciding what to carry forward into Intune.

Frequently asked questions

1. How do you manage Group Policy in Intune?

Intune does not manage Group Policy Objects directly. Instead, you use Group Policy Analytics in the Intune admin center to import GPO XML files, review which settings have Intune equivalents, and migrate supported settings into a Settings Catalog policy. Settings without an equivalent typically remain as GPOs or are recreated as custom OMA-URI profiles.

2. Does Intune have GPOs?

No. Intune uses Settings Catalog policies, Administrative Templates, and custom OMA-URI profiles instead of GPOs. The Settings Catalog is the closest functional equivalent for many ADMX-based policy settings on cloud-managed devices.

3. What are GPO and Intune?

Group Policy Objects (GPOs) are the on-premises mechanism for enforcing configuration on domain-joined Windows devices through AD. Microsoft Intune is a cloud-based MDM platform that applies configuration to enrolled devices through Configuration Service Providers over HTTPS. Both can manage Windows settings, but they use different targeting and enforcement models.

4. Is Intune replacing Group Policy?

Strategically, Microsoft is moving more Windows management into Intune. In practice, most organizations are still running both in parallel. Intune is well suited for cloud-native and remote scenarios, while GPO remains important for on-premises settings and devices that Intune cannot manage.