121: Migrate GPO to MDM policies
Implementation Effort: High
User Impact: Medium to High
Overview
Migrating from Group Policy Objects to MDM policies is a key step in moving Windows management toward a cloud-native Zero Trust model. The goal is not to recreate every historical GPO in Intune one for one. Instead, the organization should determine which controls are still needed, which can be retired, which belong in Microsoft Intune Settings Catalog or endpoint security policies, and which should be replaced by newer platform capabilities.
Implementation Guidance
- Start with discovery and rationalization, not migration. Export and review the existing GPO estate, identify duplicates and obsolete settings, and classify policies by security, configuration, app dependency, user experience, and legacy technical debt.
- Use Group Policy Analytics to understand which settings have MDM equivalents and where manual redesign is required. Treat the analytics output as input to planning, not an automatic migration script.
- Design a policy taxonomy for Intune before creating profiles. Decide what belongs in security baselines, endpoint security, Settings Catalog, configuration profiles, and proactive remediation or scripts.
- Migrate in rings and validate policy overlap carefully. During transition, the same setting may exist in GPO, Configuration Manager, and Intune; document which source should win and how conflicts will be retired.
- Prioritize policies that unlock Zero Trust outcomes, such as BitLocker, Defender, firewall, attack surface reduction, update controls, and device compliance prerequisites.
- Decommission legacy GPOs intentionally after validation. Leaving both old and new policy paths active for too long creates drift and troubleshooting friction.
Video Walkthrough
Reference
- Use Microsoft Intune to import and analyze group policies - Microsoft Intune — Explains how to use Group Policy analytics as part of migrating GPO settings to Intune.
- Create a policy using settings catalog in Microsoft Intune - Microsoft Intune — Shows how to create a settings catalog policy in Intune.
- Endpoint security in Microsoft Intune - Microsoft Intune — Introduces endpoint security policy types and management in Intune.