Training path: from Configuration Manager admin to co-management and cloud-native Intune

Microsoft doesn't offer a Configuration Manager exam today, but the next skills for a Configuration Manager (SCCM/MECM) administrator are clear: co-management, Intune and cloud-native Windows. This path turns them into a 12-week plan. Each stage has Microsoft Learn resources, lab work and checks that show the skill has really landed.

Who this path is for#

You run Configuration Manager day to day: collections, applications, software updates and perhaps task sequences. Your organisation wants to move toward Intune without a risky big-bang project. Before you start, you'll need:

• Comfort with Active Directory, Group Policy, the Configuration Manager console and its logs.
• A lab with a domain controller, a Configuration Manager site on a supported current branch version and two or three Windows 11 VMs. Never practise workload switches in production.
• A test Microsoft 365 tenant with Intune and Microsoft Entra ID P1 licences, synchronised from the lab Active Directory with Microsoft Entra Connect Sync. You'll also need a Global Administrator account for the cloud attach sign-in.
• About five hours a week.

What you'll be able to do#

• Explain how tenant attach, cloud attach and co-management differ, and when each fits.
• Prepare identity for co-management with hybrid join and automatic MDM enrollment.
• Enable co-management for a pilot collection and verify it on the device, in the console and in Intune.
• Move workloads one at a time, map Configuration Manager features to their Intune equivalents and roll back safely.
• Build a cloud-native Windows device with Windows Autopilot and Microsoft Entra join.
• Decide, device group by device group, what stays on Configuration Manager.

The Intune side of this path is covered by exam MD-102, which earns the Microsoft 365 Certified: Endpoint Administrator Associate certification. This path gets you a long way towards it, and my MD-102 study plan fills the gaps.

Stage-by-stage plan#

Stage 1 (weeks 1–2): Management models and identity#

Study: start with the Microsoft Learn module Understand endpoint management strategies and Microsoft Intune, which compares Configuration Manager, Intune and co-management. Then work through the device identity and authentication module in the learning path Prepare infrastructure for devices using Microsoft Intune and Microsoft Entra ID.

Practise: configure Microsoft Entra hybrid join in the lab and confirm it with dsregcmd /status. Co-management needs hybrid-joined or Entra-joined devices; devices that are only Entra registered aren't supported. If you get stuck, see my dsregcmd guide.

Stage 2 (weeks 3–4): Cloud attach and a co-management pilot#

Study: read the paths and prerequisites sections of Microsoft's co-management overview, and get the vocabulary straight. Tenant attach uploads Configuration Manager devices to the Intune admin center without enrolling them. Co-management enrolls them in Intune so you can split workloads between the two. If you have internet-based clients, read about the cloud management gateway, which requires the site to be onboarded to Microsoft Entra ID.

Practise: set the MDM user scope in Microsoft Entra ID and create a pilot collection. Then run the Cloud Attach Configuration Wizard from Administration › Overview › Cloud Services › Cloud Attach, with automatic enrollment set to Pilot.

Stage 3 (weeks 5–6): The first workloads#

Study: Microsoft's co-management workloads article and my guide to moving workloads without surprises. Note what each workload includes, and what happens to existing policies when it moves.

Practise: move compliance policies, then Windows Update policies, then Endpoint Protection, each to Pilot Intune first. Rebuild your update deployment rings as Intune update rings. Before you move Endpoint Protection, recreate your antimalware policies and BitLocker policies as Intune endpoint security policies.

Stage 4 (weeks 7–8): Device configuration and apps#

Study: the device configuration and app management parts of the MD-102 learning paths, plus choosing the right Intune policy type.

Practise: import a GPO into Group Policy analytics and rebuild its supported settings in the settings catalog. Turn one configuration baseline into an Intune Remediation. Package an application as a Win32 app and move the Client apps workload to Pilot Intune. Remember that switching Device configuration also moves Resource access and Endpoint Protection.

Stage 5 (weeks 9–10): Cloud-native provisioning#

Study: the modules Plan and implement device enrollment using Microsoft Intune and Deploy Windows devices using Windows Autopilot, both in the learning path from stage 1.

Practise: register a VM's hardware hash and build a user-driven Microsoft Entra join profile, as described in Windows Autopilot from scratch. Then reach an on-premises file share from that VM by using Windows Hello for Business cloud Kerberos trust. This shows that an Entra-joined device can still use on-premises resources.

Stage 6 (weeks 11–12): Operate and decide the end state#

Practise: write a decision table for your device groups. New and refreshed laptops are good candidates for Autopilot and cloud-native management. Other groups may stay co-managed for now, while servers, heavy task-sequence imaging and disconnected networks often stay with Configuration Manager longer. Also rehearse a rollback: switch one workload back to Configuration Manager in the lab. Microsoft notes that switching back can have side effects; for example, Windows and Office versions that Intune installed stay at the later version.

Hands-on practice#

Work through these lab exercises and don't move on until you get the "good" result:

1. Hybrid join: dsregcmd /status on a lab VM shows AzureAdJoined : YES and DomainJoined : YES.
2. Co-management pilot: CoManagementHandler.log records the enrollment and the DeviceManagement-Enterprise-Diagnostics-Provider › Admin event log shows event 75 (auto MDM enrollment succeeded). The device shows Co-managed in the Intune admin center.
3. Compliance workload: after moving it to Pilot Intune, the pilot device reports a compliance state against your Intune compliance policy.
4. Endpoint Protection workload: change one scan setting in an Intune antivirus policy and watch Get-MpPreference pick it up. Until then, the Configuration Manager value stays in place.
5. Apps: install your Win32 app from Intune on a co-managed device and follow it in the Intune Management Extension logs.
6. Autopilot: a VM goes from the out-of-box experience to the desktop with nothing more than a user sign-in. dsregcmd /status then shows AzureAdJoined : YES and DomainJoined : NO.
7. Rollback: move one workload back to Configuration Manager and write down what changed on the device.

After the path#

• Get certified: book MD-102 when the Intune side feels routine. Microsoft updates the exam's study guide regularly, so check it again before you book.
• Write the plan for real: turn your stage 6 decision table into a production roadmap with pilot groups, success criteria and rollback steps for each workload.
• Broaden: if you also own security or identity, continue with the SC-200 or SC-300 paths.
• Stay current: read the "What's new" notes for each Configuration Manager release and Intune's weekly "What's new" page, because workload behaviour and Intune features keep changing.

References#

• What is co-management?
• Co-management workloads
• Prepare infrastructure for devices using Microsoft Intune and Microsoft Entra ID