Entra ID and Intune device management
On a domain, a laptop takes its instructions from a server it can only reach from the office. We move the client’s devices to Entra ID and Intune, so settings, apps and updates reach them wherever they connect, and we deal with the group policy, user files and on-premises leftovers that make the move harder than it looks.
Where a device gets its instructions
Group policy was designed for desktops that never left the building. It applies when the computer can reach a domain controller, so a laptop that has worked from home for a month is running whatever it was last told, signing in with a cached password, and missing updates if they come from a server in the office.
With Entra ID and Intune, the device’s identity lives in Entra ID and its configuration, apps and update settings live in Intune. It checks in over the internet, and Intune can report whether each device is compliant rather than assuming it.
Changing where a device is joined is a small part of the job. Most of the work is everything that relied on the old arrangement: years of group policy objects, files that only exist on a C: drive, printers and drives mapped by logon scripts, and Wi-Fi that trusts domain computers.
Every group policy setting gets a decision
We export the client’s group policy and run it through Group Policy Analytics in Intune, which reports which settings have a direct equivalent. That report is the starting point. For each setting we ask what it was for and whether it still needs to exist. Most end up in one of four places.
Recreate
Still needed, and Intune has it. Rebuilt to do the same job rather than copied line by line.
Replace
The cloud model has a better way to do the same job. Built the new way.
Retire
Written for a problem that no longer exists. Recorded, then left behind.
Plan around
Depends on the domain or the office network. Kept working, with a plan for what comes next.
| Group policy setting | Decision | What happens instead |
|---|---|---|
| Folder redirection to a home folder share on the file server | Replace | OneDrive Known Folder Move takes over Desktop, Documents and Pictures, and it is finished before any device changes. |
| BitLocker, with recovery keys stored in Active Directory | Replace | Intune disk encryption policy, with recovery keys stored in Entra ID so they can be found without a domain controller. |
| Local administrator passwords from legacy LAPS, or one shared password everywhere | Replace | Windows LAPS, with each device’s password backed up to Entra ID and rotated. |
| WSUS server and update deferral settings | Replace | Update rings in Intune, with a small pilot group ahead of everyone else. Devices no longer need to reach the update server. |
| Software installation from assigned MSI packages | Replace | Packaged as Intune apps with detection rules, so an install is reported as done rather than assumed. |
| Screen lock after inactivity, sign-in banner text | Recreate | Set in the Intune settings catalog, usually as a direct match. |
| Microsoft Edge and Microsoft 365 Apps administrative templates | Recreate | Most have settings catalog equivalents. Each is checked for whether it still reflects how the client works. |
| Windows Defender Firewall profiles and rules | Recreate | Intune firewall policy. Rules are reviewed, because inbound exceptions added for an old server often outlive it. |
| Internet Explorer settings | Retire | The browser is gone. Anything Edge still relies on, such as an IE mode site list or the intranet zone used for single sign-on, becomes an Edge setting instead. |
| Templates for Windows and Office versions no longer in the fleet | Retire | Recorded in the documentation and not carried across. |
| Restrictions added years ago that nobody can explain, such as hiding Control Panel | Retire | Only after asking. Some turn out to matter, and those are recreated. |
| Logon scripts that map network drives | Plan around | Entra-joined devices can still reach file shares with single sign-on when the user account is synced and the device can see a domain controller. We plan whether the mappings stay as they are, are deployed from Intune, or change when the shares move. |
| Printers deployed from a print server | Plan around | Planned site by site: kept on the print server for now, or installed directly on the devices. |
| Wi-Fi that authenticates the computer account (802.1X) | Plan around | An Entra-joined device isn’t a domain computer, so a RADIUS server that checks computer accounts will refuse it. This is identified, and a certificate-based approach agreed, before the first device moves. |
Typical settings found in a small business domain. The client’s own list is what we work from.
Two ways to move a device that’s already in use
New devices are straightforward: they go through Autopilot from the start. Devices people are using today need a choice, and it is made device by device. Using both in one fleet is common.
Before either: user folders are in OneDrive
Known Folder Move is turned on, and we check that each device has finished syncing, rather than only that the policy arrived. Anything kept outside those folders, like a data folder on the C: drive or files in a local app’s own folder, gets a decision before the device changes.
Reset with Autopilot
The device’s hardware hash is registered with Autopilot, Windows is reset, and the user signs in to a clean build that Intune configures as they watch.
- What the user notices
- A fresh desktop. Files come back from OneDrive and apps install from Intune.
- When it suits
- Devices in reasonable shape, especially ones carrying years of local clutter and leftover software.
- The downside
- Anything that isn’t in OneDrive or packaged in Intune doesn’t come back, so the preparation has to be thorough.
Migrate the profile in place
A profile migration tool takes the device off the domain, joins it to Entra ID and points the user’s existing Windows profile at their Entra account.
- What the user notices
- The same desktop and local apps, with a new way of signing in.
- When it suits
- A reset would cost too much: a specialised workstation, software that’s hard to reinstall, or someone who can’t lose a day.
- The downside
- Whatever was wrong with the old build comes along too, so the device still needs bringing into line with the Intune baseline.
Either way, the device ends up in the same place
Joined to Entra ID, enrolled in Intune and on the same baseline as every new device, with group policy no longer applying to it.
Where these projects go wrong
None of these are unusual. They are the details that decide how the change lands with staff.
-
The first person to sign in becomes an administrator
Join a device to Entra ID by hand and the person who joined it is a local administrator on it. An Autopilot profile has its own user account type setting, and it is easy to leave on the wrong value.
We set the Autopilot profile to standard user and keep administrator access deliberate, through Windows LAPS and named roles.
-
The setup screen becomes an install queue
Every app the Enrollment Status Page waits for has to finish before the user sees a desktop. Too many and setup slows down or fails.
Only what someone needs at first sign-in blocks setup. Everything else installs afterwards.
-
Two sets of rules at once
A device still on the domain can receive group policy and Intune policy for the same setting, and when the two disagree, the result isn’t always the one anyone intended.
Group policy is removed or filtered away from each device as it moves, rather than from all of them at the end.
-
Windows Hello, then a password prompt at the file server
Staff who sign in with Windows Hello on an Entra-joined device need a trust between Entra ID and the domain, usually cloud Kerberos trust, to reach on-premises shares without being asked for credentials.
It is set up before the first device moves.
-
Compliance that nothing acts on
A compliance policy marks devices as compliant or not. On its own, that is a report. It only blocks access once a Conditional Access policy requires a compliant device.
We build compliance so it is ready to enforce, and tell you what turning enforcement on involves.
-
Hybrid join that never ends
Hybrid join keeps a device on the domain and in Entra ID at once. It can help as an interim step, but as an end state it keeps every dependency on the domain controller.
If it is used, it is a stage with a planned exit.
What the client ends up with
Device management that works the same in the office, at home and on the road, and doesn’t depend on a domain controller to keep devices configured.
A new laptop that the supplier has registered with Autopilot can go straight to the staff member. They sign in with their work account, and their settings, apps and OneDrive files follow.
A lost or stolen laptop can be wiped from Intune, and its BitLocker recovery key is in Entra ID.
Updates go out in rings, a pilot group first, and Intune shows which devices have them.
Anyone looking after the client later can see why each setting exists, because the group policy decisions are written down.