What Does Co-management Mean?

Think of co-management like having both a trusted older car and a brand-new electric vehicle. The older car (Configuration Manager) has been reliable for years, handling all your heavy hauling and long trips. The new EV (Intune) is modern, efficient, and easy to maintain, but you are not ready to give up the old car entirely because it still does some things better. With co-management, you can keep using the older car for what it is best at, like towing a trailer or driving in snow, while using the new EV for everyday commuting. In IT terms, that means keeping some management tasks on your existing Configuration Manager infrastructure, like installing complex enterprise software or managing updates on legacy systems, while moving other tasks, like setting security policies or managing mobile devices, to Intune in the cloud. You can decide workload by workload which system handles it. For example, you might set Intune to manage antivirus policies and Windows Update settings while Configuration Manager continues to deploy specialized line-of-business applications. This hybrid approach gives you the flexibility to adopt cloud management gradually. You do not have to flip a switch and move everything at once, which reduces risk and avoids a steep learning curve for your IT staff. Over time, as Intune gains more capabilities and your organization becomes comfortable with the cloud, you can shift more workloads to Intune, eventually transitioning fully to modern management if that is the goal. Co-management is not a permanent state for everyone, but it is the bridge that allows a smooth, controlled migration from legacy on-premises management to a cloud-first model without disrupting users or compromising security.

Another way to understand co-management is to imagine a home renovation where you keep your old furniture while gradually replacing it with new pieces. You do not throw out your couch just because you bought a new chair. You arrange both in the same room until you decide which pieces work best. Similarly, co-management lets you keep your existing Configuration Manager infrastructure while integrating Intune, so your devices are managed by both at the same time. The devices register with both services, and a workload slider in the co-management configuration lets you choose which system has authority for each management area, such as device configuration, app deployment, or endpoint protection. This means no conflict arises because each workload is assigned to only one manager. The result is a unified management experience where all policies and applications reach the device, whether they come from on-premises or cloud, and you get a single reportable view of device compliance and health.

Co-management also solves a practical problem: many organizations have thousands of devices that are deeply integrated with Configuration Manager, and migrating them all at once would be disruptive and risky. Co-management allows a phased approach. You can start with a pilot group of devices, validate that Intune works well for your needs, and then expand gradually. It also takes advantage of the internet-based capabilities of Intune, making it easier to manage remote and mobile workers who may never connect to the corporate network. For IT professionals studying for the MD-102 exam, understanding co-management is critical because it is a core strategy that Microsoft recommends for organizations that are not ready to fully abandon Configuration Manager but want to take advantage of cloud features like conditional access, self-service device enrollment, and real-time compliance monitoring.

In short, co-management is the practical, safe path to modern device management. It respects what already works while opening the door to what is possible in the cloud.

Co-management is a Microsoft solution for Windows 10 and Windows 11 devices that allows simultaneous management by both Configuration Manager (formerly SCCM) and Microsoft Intune. It was introduced to help organizations transition from traditional on-premises management to cloud-based modern management without requiring a full cutover. Co-management requires Windows 10 version 1709 or later (or Windows 11), Azure Active Directory (Azure AD) hybrid join or Azure AD join, and Configuration Manager version 1710 or later with an Intune subscription. The devices must be enrolled in both Configuration Manager and Intune, and the co-management configuration is applied via client settings in Configuration Manager.

When co-management is enabled, a workload slider in the Configuration Manager console allows administrators to choose which management authority handles each of several workload categories. These workloads include Device Configuration, Compliance Policies, Resource Access Policies, Windows Update Policies (including Windows Update for Business), Endpoint Protection (now Microsoft Defender for Endpoint), Office 365 Click-to-Run, Mobile Apps, Client Apps, and the Microsoft Edge browser. Sliding a workload from Configuration Manager to Intune means that Intune becomes the authority for policies in that area. For example, if you slide the Endpoint Protection workload to Intune, then Intune will manage Microsoft Defender for Endpoint configuration on the device, and Configuration Manager will no longer apply its policies in that area. The slider is granular, so you can move workloads one at a time as your organization becomes ready. The device itself operates under a single client agent that communicates with both services. The Configuration Manager client and the Intune Management Extension (IME) coexist on the device, and the IME is automatically installed when co-management is enabled.

From a networking and protocol standpoint, co-management relies on existing Configuration Manager communication channels (HTTPS, HTTP, or TCP) for on-premises tasks, and Intune uses HTTPS over the internet for cloud tasks. Devices must be able to reach the Intune service endpoints, which include manage.microsoft.com and various CDNs. Azure AD authentication is used for device identity and enrollment. The co-management enrollment process begins in Configuration Manager by creating a co-management policy. This policy defines the pilot collection (a subset of devices) or the entire device collection to be co-managed. Devices in the pilot automatically receive the configuration and start the Intune enrollment process. The device must be Azure AD joined or hybrid Azure AD joined to complete enrollment. Once enrolled, the Intune Management Extension downloads on the device, and the device appears in both Configuration Manager and Intune consoles. The two consoles display the same device, and you can see which workloads are managed by which authority.

In an exam context for MD-102, candidates must understand that co-management is not an either/or scenario. It is a strategy for transitioning. Key prerequisites include having an Intune license (Enterprise Mobility + Security or Microsoft 365 E3/E5), configuring Azure AD hybrid join, and ensuring devices are running a supported Windows version. The exam also tests the concept of the workload slider and the order of transitioning workloads. Microsoft recommends starting with simple workloads like Windows Update Policies or Endpoint Protection, then moving to Compliance Policies and Device Configuration, and finally moving Client Apps after validating the cloud environment. Co-management also supports a feature called automatic enrollment, where devices that are already managed by Configuration Manager automatically enroll in Intune without user interaction. This is a common scenario in enterprise environments. Co-management integrates with conditional access, allowing Intune compliance policies to be enforced on co-managed devices, and with Windows Autopilot, which can be used for new device provisioning in a co-managed environment.

Exam takers should also note that co-management does not require you to decommission Configuration Manager. You can keep it running for legacy needs, custom scripts, or complex application sequencing that Intune cannot handle. However, the goal of co-management is to eventually move all workloads to Intune, enabling a true modern management approach with cloud-based, internet-facing capabilities. The MD-102 exam expects you to know how to configure co-management, how to use the workload slider, and how to troubleshoot common issues such as enrollment failures, missing co-management policies, or devices not appearing in Intune. Understanding co-management is fundamental to the exam because it is a primary deployment strategy for organizations that already have Configuration Manager and are moving to the cloud.

Co-management matters because it solves one of the most difficult challenges in enterprise IT today: moving from legacy on-premises device management to cloud-first management without causing downtime, user frustration, or security gaps. Many organizations, especially large enterprises, have invested heavily in Configuration Manager infrastructure, with thousands of custom policies, application deployments, and compliance rules. Ripping all that out and replacing it overnight with Intune would be risky and disruptive. Co-management provides a practical migration path that allows IT teams to start small, validate cloud management, and gradually expand while keeping existing processes intact. This reduces the pressure on IT staff to learn everything about new tools immediately and allows them to leverage their existing expertise while building new skills.

From a business perspective, co-management enables organizations to take advantage of cloud benefits such as always-on connectivity, real-time reporting, conditional access security, and the ability to manage devices from anywhere. It also helps with compliance and security, because Intune integrates directly with Azure AD and Microsoft Defender, allowing for granular conditional access policies that block devices not meeting compliance standards. For remote workers, co-management is especially valuable because Intune can manage devices that never connect to the corporate network, while Configuration Manager can still handle on-premises devices that need complex software deployments. This hybrid approach ensures that all devices are managed consistently, regardless of location.

For IT professionals, learning co-management is not just about passing an exam, it is about being able to design and execute a real-world migration strategy. The MD-102 exam, which focuses on modern desktop deployment and management, heavily emphasizes co-management as a core skill. Understanding how to configure it, how the workload slider works, and how to troubleshoot it is essential for any administrator working in a Microsoft-centric environment. Co-management also matters because it is a key requirement for using other Microsoft technologies like Windows Autopilot and Desktop Analytics. These tools rely on devices being enrolled in Intune, and co-management provides that enrollment path for existing ConfigMgr-managed devices. Ultimately, co-management is the bridge between the old world and the new, and knowing how to build that bridge is a critical skill for any IT certification candidate.

Exam questions about co-management typically fall into three categories: scenario-based questions, configuration step questions, and troubleshooting questions. In scenario-based questions, you are given a description of an organization that currently uses Configuration Manager and wants to begin using Intune. You might be asked what the first step should be. Options could include 'Deploy the Intune client to all devices,' 'Configure Azure AD hybrid join,' or 'Create a co-management policy in Configuration Manager.' The correct answer is usually to ensure that devices are Azure AD hybrid joined first, because that is a prerequisite. Another variation gives you a list of workloads and asks which ones can be managed by Intune after sliding the slider. You must know that all nine workloads are movable, but some require additional licenses, like Microsoft Defender for Endpoint for the Endpoint Protection workload.

Configuration step questions might present a series of steps in random order and ask you to put them in the correct sequence. For example: 1) Assign Intune licenses to users. 2) Create a pilot collection in Configuration Manager. 3) Enable co-management via the Configuration Manager console. 4) Configure Azure AD hybrid join. 5) Slide workloads as desired. The correct order is 4, 1, 2, 3, 5. These questions test your understanding of dependencies. You cannot enable co-management without Azure AD hybrid join and a license. You must create the pilot collection before enabling co-management, and you must enable co-management before you can slide workloads.

Troubleshooting questions often present a conflict or error. For example, 'A company has co-management enabled, but devices in the pilot group are not appearing in Intune. What is the most likely cause?' Possible answers could be 'The devices do not have the Configuration Manager client installed,' 'The Intune license is not assigned to the user or device,' 'The co-management policy is set to the wrong collection,' or 'The workload slider for client apps is set to Intune.' The correct answer is usually about the Intune license not being assigned, because even if the policy is configured, the device will not enroll without a license. Another common troubleshooting question involves compliance policies: 'After sliding the Compliance Policies workload to Intune, devices are still reporting non-compliant from Configuration Manager. Why?' The answer is that you must also remove or disable the compliance policies in Configuration Manager, because sliding does not automatically remove existing policies; it only prevents new ones from being applied from Configuration Manager. These question types test your practical understanding of how co-management behaves in real environments.

You may also see questions that combine co-management with other concepts like Windows Autopilot, Desktop Analytics, or conditional access. For instance, 'You are deploying Autopilot for new devices, but the existing devices are co-managed. How do you ensure that new Autopilot devices are also co-managed?' The answer is to configure the Autopilot deployment profile to automatically enroll devices in Intune, and then manually add the Configuration Manager client to those devices if needed, because Autopilot does not automatically deploy the ConfigMgr client. These integrated questions require a broad understanding of the Microsoft device management ecosystem. To ace co-management questions, focus on prerequisites, workload slider details, and common enrollment issues. Know the recommended order of moving workloads, and remember that co-management is a migration tool, not a permanent state for most organizations.

Co-management is a practical tool that every IT professional dealing with Microsoft device management should understand deeply. In the real world, you will rarely encounter an organization that is willing to drop everything and move to Intune overnight. There is too much legacy. So co-management becomes your daily reality for months or even years. The key to success is understanding the workload slider. This slider is found in the Configuration Manager console under Administration, Cloud Services, Co-management. There are nine workloads you can slide independently: Compliance Policies, Device Configuration, Resource Access Policies, Windows Update Policies, Endpoint Protection, Office 365 Click-to-Run, Mobile Apps, Client Apps, and Microsoft Edge Browser. Each workload has a single authority, either Configuration Manager or Intune, after sliding. When you slide a workload to Intune, Intune policies become active and Configuration Manager policies for that area are ignored, but not deleted. That is an important nuance: the policies remain in Configuration Manager, so you should delete or disable them to avoid confusion. Also, note that you cannot slide a workload in reverse without re-enabling the Configuration Manager policies.

Another practical aspect is the enrollment process. When co-management is enabled, devices that are already managed by Configuration Manager automatically receive the Intune Management Extension via client notification. The extension contacts Intune and enrolls the device. This is called 'automatic enrollment' and requires no user interaction. However, if the device is not Azure AD hybrid joined, enrollment will fail. For new devices enrolled via Autopilot, you can install the Configuration Manager client manually or via Intune to achieve co-management. In practice, many organizations use co-management to gradually shift work to Intune while maintaining support for complex applications that require scripting, sequencing, or specific deployment rings that Intune cannot easily replicate.

Troubleshooting co-management often involves checking the Configuration Manager client log files, such as CoManagementHandler.log and MECMStatus.log, to see enrollment status. Common issues include: the Intune license not being assigned, incorrect Azure AD tenant configuration, or network blocks preventing communication with Intune endpoints. Another frequent problem is when you slide a workload but the devices do not respond to the new Intune policies. This usually happens because the existing Configuration Manager policies are still cached on the device. You should force a policy retrieval on a test device to see which policies are applying. Also, remember that co-management is not a one-time setup. As your organization grows, you may add new workloads, expand the pilot, or even decide to decommission Configuration Manager. The slider makes this gradual migration possible, and mastering it is essential for the MD-102 exam and for your role as an IT administrator.