How to Setup SCCM CB Intune Co-Management Configuration Manager ConfigMgr

How to Setup SCCM CB Intune Co-Management Configuration Manager ConfigMgr. Many organizations are looking for more simplified management options for Windows devices.

There are two ways of managing: the traditional way of control and the Modern way of governance. Both are explained in detail below.

They also want an easier transition from SCCM and Domain Join devices (Traditional) to a modern management approach with Intune and Azure AD Join devices (Modern). This post will show How to set up SCCM CB and InTune Co-Management.

Another post covers more “Management strategic” details about co mgmt – Overview Windows 10 Co-Management with Intune and SCCM.

• SCCM CB Release has Changed 2 Versions per Year | March and September
• SCCM CB 1803 Review of Upgrade and Features Configuration Manager ConfigMgr
• Video Review of SCCM CB 1802 New Features
• Reset SCCM CB Critical Site Component Status Summarizer Counter ConfigMgr

How to Set SCCM CB Intune Co-Management

In this video, you will learn all the details about setting up SCCM CB Intune Co-Management. Below is more information about the SCCM CB 1709 upgrade and Co-Management setup via Video Tutorial.

How to Setup SCCM CB Intune Co-Management Configuration Manager ConfigMgr

The co-management option is available only on a Preview release of SCCM CB 1709. I don’t know whether it will make it to the SCCM CB 1710 Production release in a few months. However, Co-Management will be available in the SCCM CB 1710 production release.

Modern IT
Multiple Devices
User and Business Owned
Cloud Managed & SaaS Apps
Automated
Proactive
Self Service

What is Co-Management?

In simple terms, SCCM CB co-management is a dual management capability offered for Windows 10 1709 (Fall Creators Update) devices. InTune and SCCM can manage Windows 10 1709 devices simultaneously.

For example, eligible Windows 10 devices will be managed via the SCCM client, and the Intune MDM channel will handle other workloads. The section below this post provides more details about the Workloads.

This co-management is only available for the Intune subscriptions; set INTUNE as MDM authority.

You might wonder how we can handle policy conflicts in the SCCM Co-Management scenario. Yeah, disputes regarding configuration/compliance policies will be controlled via Co-Management Configuration policies in SCCM CB.

You can select which workloads can be managed via Intune. All other SCCM workloads will be handled through the SCCM management method.

Where Can We Set up SCCM Co-Management Policies?

Install or Upgrade SCCM CB 1709 or a later version of SCCM. Navigate the SCCM CB 1709 (or later) console via \Administration\ Overview\ Cloud Services\Co-management. Click on the button “Configure Co-Management” to create Co-management Production or Co-Management Pilot policies.

SCCM CB Co-Management Configuration Wizard – STAGING Options?

There are 2 staging options available in SCCM CB co-management. Following are the 2 options:-

1. Co-Management Production Policies (CoMgmtSettingsProd)
2. Co-Management Pilot Policies (CoMgmtSettingsPilot)

Configure Roll-out Groups – Pilot Collection

Configuring co-management will only be enabled for a selected pilot collection.  Selected Window 10 1709 or later devices will be in the pilot group for Co-Management.  This pilot group of this collection can be used for a staged co-management roll-out.

We can initiate automatic enrollment or move workloads to InTune for devices in the pilot group before you roll out co-management to all supported Windows 10 devices in your production environment.

Configure Co-management for Production Collection with Exclusion Collection

Configure co-management policy for production. You may select an exclusion group that will be excluded from co-management in your production environment. Exclusion groups can be any collection of Windows 10 devices.

How Can SCCM Co-Management for SCCM Clients and Intune Managed Devices be Enabled?

There are two ways to enable SCCM co-management for Windows 10 1709 devices.

1. Enable Co-management for SCCM Clients
2. Enable Co-management for Intune-managed devices

Enable Co-management for SCCM Clients

You must select the following option to enable co-management for SCCM-managed devices with Intune: To enable co-management for devices managed by SCCM and configured, select ALL or Pilot from the drop-down menu to manage all/pilot SCCM clients via Intune.

Enable Co-management for Intune Managed Devices

You must create an Intune application to enable co-management for Intune-managed devices with SCCM. This application will install the SCCM client onto Intune-managed devices.

The SCCM team provided a sample command line to install the SCCM client. Following is the sample command line provided in the wizard

• CCMSETUPCMD=”/mp:https:// CCMHOSTNAME= SMSSiteCode= SMSMP=https:// AADTENANTID= AADTENANTNAME= AADCLIENTAPPID= AADRESOURCEURI= SMSPublicRootKey=”

What are SCCM Co-Management Workloads?

SCCM Co-Management workloads are functionalities/features of device management. For example, the Compliance policies, Configuration Policies, Software Updates, Resource Access policies (WiFi Profiles/VPN Profiles, etc..), Application deployment, etc., are co-management workloads.

How Do You Configure/Select Workloads for Co-management?

SCCM continues to manage all device management workload functionalities even after enabling the co-management option. When you decide you are ready for co-management, you can use Intune to manage available workloads.

Co-Management Configuration Wizard provides the ability to select these functionalities /features. Following are the 3 features enabled for co-management

• Compliance Policies (this will work with Conditional Access)
• Resource Access Policies (WiFi, SCEP, etc..Anything comes under the SCCM console Company Resource Access node)
• Windows Update Policies (Patching without on-prem WSUS/SUP)

For Windows 10 devices that are in a co-management state. You can have Microsoft Intune start managing different workloads/features. Choose pilot Intune to have Microsoft Intune start managing different workloads.

Choose Pilot Intune to have Intune manage the workloads for only clients in the pilot groups. If you want to manage these workloads with SCCM, select ConfigMgr/SCCM. If you’re going to manage these workloads with Intune, select Intune.

Resources

• Co-management for Windows 10 devices – SCCM 1709 Preview – here
• Migrate hybrid MDM users and devices to Intune standalone – here
• Microsoft 365 and SCCM Windows 10 Co-Management – here

We are on WhatsApp now. To get the latest step-by-step guides, news, and updates, Join our Channel. Click here. HTMD WhatsApp.

Author

Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.