Group Policy has been the standard Windows management tool for over two decades. Intune is the cloud-based replacement for organisations moving to modern device management. This guide explains the key differences, when to use each, and how to approach migrating from GPO to Intune.
Key differences
When Group Policy still makes sense
- Your devices are domain-joined and will stay on-premises
- You have complex policy requirements not yet in Intune Settings Catalog
- You rely on computer startup/logon scripts that need domain connectivity
- You use GPO preferences for drive mappings and printer deployment alongside existing infrastructure
- You are in a regulated environment that requires on-prem policy control
When Intune is the better choice
- Devices are Entra ID joined (not domain joined) - GPO will not apply at all
- You have remote workers who are rarely or never on the corporate network
- You need to manage personal (BYOD) devices
- You want app deployment, compliance enforcement, and Conditional Access in one place
- You are moving to Microsoft 365 and want a fully cloud-managed estate
Intune equivalents for common GPO settings
Migrating from GPO to Intune
Microsoft provides the Group Policy Analytics tool in Intune to help with migration:
- Export your GPOs from GPMC as XML files
- Import them into Group Policy Analytics
- Intune analyses each setting and shows whether it has an Intune equivalent
- Click Migrate to automatically create a Settings Catalog profile from supported GPO settings
Running both at the same time
Hybrid Entra ID join lets devices receive both GPO (from the domain controller) and Intune policies. This is common during a migration period. A few things to be aware of:
- When the same setting is configured in both GPO and Intune, Intune wins on most settings for Entra ID joined devices
- Keep track of what is configured where to avoid conflicts and confusion
- Use the Intune compliance dashboard to identify devices receiving conflicting policies
- Plan a timeline to move off GPO entirely as you gain confidence in Intune coverage
Frequently Asked Questions
It depends on your infrastructure. If you have on-premises Active Directory and domain-joined devices, Group Policy is still a valid option. If devices are Entra ID joined or you need to manage remote and BYOD devices, Intune is the better choice. Most organisations transitioning to cloud are moving from GPO to Intune over time.
For most settings, yes. Intune covers nearly all the security and configuration settings that were traditionally done via GPO, plus it adds app deployment, compliance, and Conditional Access. Some complex or niche GPO settings may not have an Intune equivalent yet, but the gap closes with each Intune release.
Yes. Many organisations run both during a transition period. Devices can be hybrid Entra ID joined (both AD domain joined and Entra ID registered) and receive both GPO and Intune policies. When conflicts occur, Intune policy generally wins on Entra ID joined devices.
Intune uses Configuration Profiles (Settings Catalog) for most policy settings. The Settings Catalog covers the same ADMX-backed settings as GPO for Windows. You can also import custom ADMX templates directly into Intune for third-party app policies.