Latest / The Identity Blueprint / What Actually Breaks When You Migrate GPOs

Transcript

What Actually Breaks When You Migrate GPOs · The Identity Blueprint

• 0:00
  SPEAKER_01: Welcome back to the Identity Blueprint, Beyond the Domain.
• 0:03
  SPEAKER_01: I'm Ernie with Jose.
• 0:05
  SPEAKER_01: This episode is about the moment every admin realizes Microsoft never built a cloud version of Sysfal, and why that's actually a deliberate engineering decision, not an oversight.
• 0:17
  SPEAKER_01: We trace exactly how Intune replaces group policy with API-driven configuration profiles, why a four-megabyte file size limit exists purely to punish 15 years of policy debt, and the one category of legacy GPO that fails to translate no matter what you do.
• 0:36
  SPEAKER_01: WMI filters.
• 0:37
  SPEAKER_01: We also get into loopback merge, the trick that lets a shared hospital kiosk enforce a policy meant for a person, not a machine.
• 0:45
  SPEAKER_01: If you're staring down 2,000 legacy GPOs and a migration deadline, this episode is for you.
• 0:51
  SPEAKER_01: Let's get into it.
• 0:53
  SPEAKER_01: Imagine demolishing your company's physical headquarters.
• 0:57
  SPEAKER_01: Right?
• 0:58
  SPEAKER_01: Like while 10,000 employees are still sitting at their desks actively trying to work.
• 1:02
  SPEAKER_00: Right, yeah.
• 1:03
  SPEAKER_00: Just complete chaos.
• 1:04
  SPEAKER_01: Exactly.
• 1:05
  SPEAKER_01: The roof is coming off, um, the walls are literally coming down.
• 1:09
  SPEAKER_01: But you somehow expect everyone's phone to stay connected and their files to just remain perfectly secure throughout this entire demolition.
• 1:17
  SPEAKER_00: Aaron Powell Which is, you know, impossible in the real world.
• 1:20
  SPEAKER_01: Right.
• 1:21
  SPEAKER_01: But that chaotic structural teardown is exactly what you are doing to your enterprise IT infrastructure when you uh when you decide to rip out on-premises Active Directory.
• 1:31
  SPEAKER_00: Trevor Burrus, Jr.
• 1:31
  SPEAKER_00: It really is.
• 1:32
  SPEAKER_00: I mean, it's a massive architectural trauma.
• 1:34
  SPEAKER_00: You're pulling the foundation out from under like two decades of established operating procedures.
• 1:39
  SPEAKER_00: Yeah.
• 1:39
  SPEAKER_00: And the reality is most IT departments approach this transition, treating the cloud like it's just uh a fancy new data center.
• 1:47
  SPEAKER_00: They think they can just lift and shift all their old rules.
• 1:49
  SPEAKER_01: All the old lift and shift.
• 1:51
  SPEAKER_00: Right.
• 1:51
  SPEAKER_00: And they find out very quickly, usually the hard way, that the cloud absolutely does not care about your legacy infrastructure.
• 1:57
  SPEAKER_01: Aaron Powell Which is why we have a singular mission for you today on this deep dive.
• 2:01
  SPEAKER_01: We are unpacking the reality of what actually happens to group policy when an organization completely severs its ties with on-premises Active Directory.
• 2:11
  SPEAKER_00: Aaron Powell Because it's not pretty.
• 2:12
  SPEAKER_01: No, it's not.
• 2:14
  SPEAKER_01: We're going to look at the exact mechanics of replacing it with Microsoft and Tune, the grueling reality of the policy translation gap, and how you use co-management to avoid completely breaking your endpoints.
• 2:26
  SPEAKER_01: Aaron Powell Right.
• 2:26
  SPEAKER_00: And we're bypassing the basic definitions today.
• 2:29
  SPEAKER_01: So Yeah, you already know what a domain controller is.
• 2:31
  SPEAKER_01: We are getting into the guts of the system today.
• 2:33
  SPEAKER_00: Aaron Powell Absolutely.
• 2:34
  SPEAKER_00: And to do that effectively, you know, it really helps to anchor this in reality.
• 2:38
  SPEAKER_00: Consider a hypothetical but um very standard scenario.
• 2:42
  SPEAKER_00: Okay, let's hear it.
• 2:43
  SPEAKER_00: So a sprawling 5,000 endpoint regional hospital network, they have decades of legacy infrastructure.
• 2:49
  SPEAKER_01: Aaron Powell Oh man, hospitals are the worst for legacy tech.
• 2:52
  SPEAKER_00: Oh yeah.
• 2:52
  SPEAKER_00: You've got nurses sharing kiosk workstations, you have mobile doctors roaming around and like massive compliance requirements.
• 2:59
  SPEAKER_00: So when they decide to go cloud native and adopt intra ID, the very first thing that breaks is their entire method for managing those 5,000 devices.
• 3:08
  SPEAKER_01: Aaron Powell Because the anchor is gone.
• 3:10
  SPEAKER_00: Exactly.
• 3:11
  SPEAKER_00: Because to understand how to move forward, you have to understand the fundamental engineering dependency that is suddenly, you know, just being destroyed.
• 3:20
  SPEAKER_01: Aaron Powell Well, let's start right there.
• 3:21
  SPEAKER_01: Group policy objects or GPOs have been the absolute law of the land for Windows management since what, Windows 2000?
• 3:29
  SPEAKER_00: Yeah, a long time.
• 3:30
  SPEAKER_01: And their entire enforcement mechanism relies on a very specific localized conversation.
• 3:35
  SPEAKER_01: Correct.
• 3:35
  SPEAKER_01: Like the group policy client service on a Windows machine has to talk to the system volume folder, the SYS VL, on a local domain controller.
• 3:43
  SPEAKER_00: That is the umbilical cord right there.
• 3:45
  SPEAKER_00: I mean, group policy does not exist as an independent entity.
• 3:48
  SPEAKER_00: When that hospital workstation boots up, it makes a synchronous RPC call over the local area network, it reaches out, um, authenticates with Kerberos, finds the nearest domain controller, accesses the SMB file share containing the SYS VL, and literally downloads the text files and scripts it needs to enforce the organization's will.
• 4:06
  SPEAKER_01: Aaron Powell And this is exactly where the shock sets in for admins who are moving to Intra ID.
• 4:12
  SPEAKER_01: Because the natural assumption is okay, Microsoft is hosting my directory in the cloud now.
• 4:16
  SPEAKER_01: Great.
• 4:16
  SPEAKER_01: Where's my cloud, SYSVO?
• 4:19
  SPEAKER_01: Give me the IP address so my clients can map to it.
• 4:21
  SPEAKER_00: Aaron Powell And the brutal reality is that there is no SYSVL in Intra ID.
• 4:25
  SPEAKER_00: It does not exist at all.
• 4:26
  SPEAKER_00: Microsoft did not just build a virtual SMB share in the sky.
• 4:29
  SPEAKER_01: Aaron Powell But I always push back on this when I talk to infrastructural engineers.
• 4:33
  SPEAKER_01: Like Microsoft has near infinite Azure compute resources.
• 4:36
  SPEAKER_01: Aaron Powell They have hyperfiles.
• 4:38
  SPEAKER_01: Why on earth wouldn't they just emulate SYSVL in Intra ID to make the transition seamless for everyone?
• 4:44
  SPEAKER_01: It seems so obvious.
• 4:45
  SPEAKER_00: Aaron Powell Because emulating a localized, stateful file share across a global multi-tenant cloud architecture is an engineering and security nightmare.
• 4:55
  SPEAKER_01: Aaron Powell Really?
• 4:56
  SPEAKER_01: Just because of the scale.
• 4:57
  SPEAKER_00: Aaron Powell It's the protocol itself.
• 4:59
  SPEAKER_00: SYSVL was designed for high trust, low latency local area networks.
• 5:05
  SPEAKER_00: If you try to replicate that legacy SMB traffic over the public internet for millions of distinct corporate tenants simultaneously, the latency would just be catastrophic.
• 5:16
  SPEAKER_01: Oh, I see.
• 5:16
  SPEAKER_00: Yeah.
• 5:16
  SPEAKER_00: And the security vulnerabilities would be insurmountable.
• 5:19
  SPEAKER_00: The protocol is just fundamentally incompatible with modern cloud architecture.
• 5:23
  SPEAKER_01: Aaron Powell So the physical bulletin board in the break room is just gone.
• 5:26
  SPEAKER_01: Yeah.
• 5:26
  SPEAKER_01: You can't just mail 5,000 hospital employees a piece of cork board and expect the system to work.
• 5:30
  SPEAKER_00: Aaron Powell That's a great way to put it.
• 5:32
  SPEAKER_00: Yeah.
• 5:32
  SPEAKER_01: Aaron Powell But it goes deeper than just losing the file share, right?
• 5:35
  SPEAKER_01: We are also losing the temporal events that triggered the policy in the first place.
• 5:39
  SPEAKER_00: Aaron Powell Exactly.
• 5:40
  SPEAKER_00: That is the secondary collapse.
• 5:41
  SPEAKER_00: Legacy group policy relies on a perimeter-bound temporal model.
• 5:45
  SPEAKER_01: Aaron Powell Meaning it relies on time and physical connection.
• 5:47
  SPEAKER_00: Aaron Powell Right.
• 5:48
  SPEAKER_00: Policies apply when a machine physically joins a domain, when it boots up, and uh strictly during a user logon event, the system assumes a persistent line of sight to the domain controller.
• 6:02
  SPEAKER_01: Trevor Burrus, which you don't have anymore.
• 6:03
  SPEAKER_00: Exactly.
• 6:04
  SPEAKER_00: When you move to the cloud to enter ID, there is no traditional domain join in the legacy sense, and that localized connection is permanently severed.
• 6:13
  SPEAKER_01: Aaron Powell Which means if a remote worker is sitting at a coffee shop on a Tuesday afternoon, they are completely cut off from the old enforcement mechanism.
• 6:20
  SPEAKER_00: Aaron Powell 100% cut off.
• 6:22
  SPEAKER_01: The legacy system has no direct cloud counterpart because the physics of the environment have changed.
• 6:26
  SPEAKER_01: Like you can't force a localized model onto a distributed reality.
• 6:30
  SPEAKER_00: Aaron Powell You can't.
• 6:31
  SPEAKER_00: Therefore, the organization has to adopt a completely different philosophical approach to endpoint management.
• 6:36
  SPEAKER_01: Aaron Powell Okay, so what is the new philosophy?
• 6:37
  SPEAKER_00: Aaron Powell You are no longer stamping a device with rules at 9 a.m.
• 6:41
  SPEAKER_00: and hoping it stays secure until 5 p.m.
• 6:43
  SPEAKER_00: You need a system that assumes the device is always roaming, um, always potentially compromised, and always in need of evaluation.
• 6:51
  SPEAKER_01: Aaron Powell Which brings us to the definitive replacement, Microsoft Intune.
• 6:55
  SPEAKER_00: Yes.
• 6:55
  SPEAKER_01: If SYSV all is dead, Intune is the new engine.
• 6:59
  SPEAKER_01: But we are moving from a system of static file shares to Intune configuration profiles and uh the settings catalog.
• 7:07
  SPEAKER_00: Right.
• 7:08
  SPEAKER_00: Which is a massive shift.
• 7:09
  SPEAKER_01: Let's dig into the architecture of the settings catalog.
• 7:12
  SPEAKER_01: How is it actually talking to the operating system if it's not just downloading a script over SMB?
• 7:19
  SPEAKER_00: Instead of a client service pulling text files from a server, Intune relies on an API-driven architecture built directly into the Windows client operating system.
• 7:28
  SPEAKER_00: These are called configuration service providers or CSPs.
• 7:32
  SPEAKER_01: So Intune isn't just like hacking the registry behind the scenes, it's talking to a native interface.
• 7:37
  SPEAKER_00: Aaron Powell Precisely.
• 7:38
  SPEAKER_00: A CSP is an interface in the OS that exposes specific configuration settings, things like BitLocker, Wi-Fi, or camera access directly to a mobile device management or MDM engine.
• 7:49
  SPEAKER_00: When you use the Intune settings catalog, you are essentially browsing a massive cloud native index of every available CSP on the device.
• 7:56
  SPEAKER_00: Intune just speaks directly to that API using a standardized path known as an OMA URI.
• 8:01
  SPEAKER_01: OMAUR, the Open Mobile Alliance Uniform Resource Identifier.
• 8:06
  SPEAKER_00: That's the one.
• 8:07
  SPEAKER_01: It basically acts as the mailing address for the specific setting you want to change inside the Windows brain.
• 8:12
  SPEAKER_00: Aaron Powell That's a perfect way to visualize it.
• 8:14
  SPEAKER_00: And because it's API driven, it introduces the massive philosophical shift we hinted at earlier.
• 8:20
  SPEAKER_00: Continuous enforcement.
• 8:22
  SPEAKER_01: Okay.
• 8:23
  SPEAKER_00: Policy is no longer a one-time stamp.
• 8:25
  SPEAKER_00: It is continuously enforced through MDM and MAM mobile application management enrollment.
• 8:30
  SPEAKER_01: Aaron Powell Let's apply this continuous enforcement idea to our hospital scenario.
• 8:35
  SPEAKER_01: Say an advanced user, maybe a radiology tech who has local admin rights for some specialized software decides they don't like the new restrictive screen timeout policy.
• 8:45
  SPEAKER_00: Classic scenario.
• 8:46
  SPEAKER_01: Right.
• 8:46
  SPEAKER_01: Under the old group policy model, if they went into the registry and hacked the setting to keep the screen on forever, that setting might stay broken until they logged off or rebooted, assuming they were even on the corporate network at the time.
• 8:57
  SPEAKER_00: Right.
• 8:57
  SPEAKER_00: And in a hospital environment, an unlocked screen is a massive HIPAA violation waiting to happen.
• 9:02
  SPEAKER_01: Oh, absolutely.
• 9:03
  SPEAKER_00: But with in-CUNE and modern MDM, the device handles the lifecycle locally and continuously.
• 9:09
  SPEAKER_00: If that radiology tech creates a state deviation at 2 p.m.
• 9:12
  SPEAKER_00: on a Tuesday, the local MDM agent detects the discrepancy against the enforced CSP.
• 9:17
  SPEAKER_01: So it notices the registry was changed.
• 9:19
  SPEAKER_00: Exactly.
• 9:20
  SPEAKER_00: And the device automatically takes corrective action to revert the setting, or it instantly reports the compliance state change back to the Intune cloud.
• 9:28
  SPEAKER_00: It doesn't wait for a scheduled 90-minute background refresh.
• 9:32
  SPEAKER_01: It's basically a self-healing endpoint.
• 9:34
  SPEAKER_01: But the reporting aspect is where the architecture really flexes his muscles, I think.
• 9:38
  SPEAKER_01: Because Intune splits its brain into two distinct functions, right?
• 9:42
  SPEAKER_01: Configuration policies and compliance policies.
• 9:44
  SPEAKER_00: Yes.
• 9:45
  SPEAKER_00: And conflating the two is a classic mistake I see all the time.
• 9:48
  SPEAKER_01: Aaron Powell Explain the difference.
• 9:49
  SPEAKER_00: Configuration policies set the rules.
• 9:51
  SPEAKER_00: They are the settings catalog deploying the OMA URI to enforce that five-minute screen timeout.
• 9:57
  SPEAKER_00: Compliance policies, on the other hand, define the baseline health a device must satisfy to be considered trustworthy.
• 10:03
  SPEAKER_00: They are the auditor.
• 10:04
  SPEAKER_01: Aaron Powell So configuration is the speed limit sign, and compliance is the radar gun.
• 10:08
  SPEAKER_00: Yes, exactly.
• 10:10
  SPEAKER_00: And that radar gun is wired directly into the enforcement mechanism of the cloud.
• 10:14
  SPEAKER_00: Microsoft intraconditional access.
• 10:17
  SPEAKER_00: Compliance policies act as a critical device compliance signal.
• 10:20
  SPEAKER_01: This is the real-time consequence.
• 10:22
  SPEAKER_01: If that radiology tech successfully breaks the security configuration, the compliance policy flags the device as non-compliant.
• 10:31
  SPEAKER_00: Instantly.
• 10:32
  SPEAKER_01: Intune immediately sends that signal to intra ID.
• 10:34
  SPEAKER_01: Entra ID's conditional access policy evaluates that signal.
• 10:38
  SPEAKER_01: And if the policy says require compliant device to access patient records, that text access is blocked in real time.
• 10:45
  SPEAKER_01: Mid session.
• 10:46
  SPEAKER_00: Right then and there.
• 10:47
  SPEAKER_00: No help desk ticket required, just instant isolation.
• 10:50
  SPEAKER_01: Aaron Powell It fundamentally changes the security posture from reactive to proactive.
• 10:54
  SPEAKER_01: But to make that work seamlessly for the end user, the admin has to master how settings are scoped on the endpoint itself.
• 11:00
  SPEAKER_00: Yes, scoping is huge.
• 11:02
  SPEAKER_01: We have to talk about device scope versus user scope because this trips up legacy admins constantly.
• 11:06
  SPEAKER_00: Aaron Powell It really does.
• 11:07
  SPEAKER_00: It's a massive point of confusion.
• 11:08
  SPEAKER_00: Aaron Powell Right.
• 11:09
  SPEAKER_01: So we're talking about the difference between hitting the HK local machine hive, the HKLM, versus the HK Cermintaser Hive, the HKCU.
• 11:16
  SPEAKER_01: What is the practical operational difference when you are building these Intune profiles?
• 11:21
  SPEAKER_00: Okay, so device scope settings, which write to HKLM, apply globally to the physical endpoint regardless of who logs in.
• 11:28
  SPEAKER_01: Okay, so the machine itself.
• 11:30
  SPEAKER_00: Right.
• 11:30
  SPEAKER_00: If you disable the USB ports at the device scope on a hospital kiosk, those ports are dead.
• 11:36
  SPEAKER_00: Whether the chief of medicine logs in or a temporary contractor logs in, the hardware is locked down.
• 11:42
  SPEAKER_01: And user scope?
• 11:43
  SPEAKER_00: User scope settings writing to HKCU target the specific human identity.
• 11:48
  SPEAKER_00: They apply to the user's active session and they follow that identity across any managed corporate endpoint.
• 11:53
  SPEAKER_01: So it roams with them.
• 11:54
  SPEAKER_00: Exactly.
• 11:54
  SPEAKER_00: If you have a user scope policy deploying specific medical application shortcuts to the start menu, those shortcuts follow the doctor whether they log into their private office desktop or a shared laptop on the surgical floor.
• 12:06
  SPEAKER_01: Aaron Powell But here's where the architecture gets really clever.
• 12:09
  SPEAKER_01: Loop back merge behavior.
• 12:11
  SPEAKER_00: Aaron Powell Oh, loop back is fascinating.
• 12:13
  SPEAKER_01: Yeah, what happens if I take a user scope policy, something designed to follow a human, and I accidentally or intentionally assign it to a group of physical devices in?
• 12:23
  SPEAKER_01: It's like trying to assign a personalized uniform to a locker room instead of a player.
• 12:27
  SPEAKER_00: InTune actually anticipates this.
• 12:29
  SPEAKER_00: It executes a loop back merge.
• 12:31
  SPEAKER_01: Okay.
• 12:32
  SPEAKER_00: It applies that user scope setting to every single user who happens to log in to that specific physical device.
• 12:38
  SPEAKER_01: Aaron Powell Oh, interesting.
• 12:39
  SPEAKER_00: So if you have a bank of shared workstations in the emergency room, you can assign user-scoped browser restrictions to that specific group of machines.
• 12:48
  SPEAKER_00: Anyone who logs in gets the restricted browser experience, but only while they are on those specific ER machines.
• 12:54
  SPEAKER_01: That is incredibly powerful for varied environments.
• 12:57
  SPEAKER_01: You get the granularity of user targeting with the rigid control of hardware targeting.
• 13:02
  SPEAKER_00: Exactly.
• 13:03
  SPEAKER_01: But as elegant as this new cloud native architecture is, we have to address the elephant in the room.
• 13:08
  SPEAKER_00: Aaron Powell The migration itself.
• 13:10
  SPEAKER_01: Yeah.
• 13:10
  SPEAKER_01: You have an IT director sitting at this hospital looking at 2,000 legacy group policy objects that have been accumulating since like 2008.
• 13:19
  SPEAKER_01: They can't just snap their fingers and magically transform a massive sprawling active directory SYS VL into pristine Intune CSPs.
• 13:28
  SPEAKER_00: Trevor Burrus They absolutely cannot.
• 13:29
  SPEAKER_00: And assuming they can is what leads to failed migrations.
• 13:33
  SPEAKER_00: This brings us to the most painful phase of the transition, the translation gap.
• 13:37
  SPEAKER_01: Aaron Powell There has to be a bridge.
• 13:38
  SPEAKER_01: You can't just rebuild 2,000 policies by hand.
• 13:41
  SPEAKER_01: Nobody has the time or the budget for that.
• 13:42
  SPEAKER_00: Oh, of course not.
• 13:43
  SPEAKER_01: The primary tool Microsoft provides for this is group policy analytics within the Intune portal.
• 13:48
  SPEAKER_01: Walk us through the exact mechanics of this extraction process.
• 13:51
  SPEAKER_00: So the extraction is highly manual and requires strict adherence to legacy constraints.
• 13:55
  SPEAKER_00: The IT admin must start on premises.
• 13:58
  SPEAKER_00: They open the traditional group policy management console, the GPMC.
• 14:02
  SPEAKER_00: They locate a specific GPO, right-click it, and select Save Report.
• 14:06
  SPEAKER_00: This action converts the binary settings payload of that GPO into a structured XML schema file.
• 14:12
  SPEAKER_01: And this XML file is what you actually upload to the cloud.
• 14:15
  SPEAKER_01: But the Intune parser that receives this file is incredibly fragile.
• 14:19
  SPEAKER_01: I'm looking at the constraints here, and it's a minefield.
• 14:23
  SPEAKER_01: First, the XML document must be strictly under four megabytes.
• 14:27
  SPEAKER_00: Which sounds completely arbitrary to modern admins.
• 14:30
  SPEAKER_01: Exactly.
• 14:30
  SPEAKER_01: My smartphone takes individual photos larger than four megabytes.
• 14:34
  SPEAKER_01: Why is a massive cloud platform rejecting a five-megabyte text file?
• 14:39
  SPEAKER_00: Because a four megabyte limit isn't about Azure storage capacity.
• 14:43
  SPEAKER_00: It is an intentional engineering forcing function to prevent administrative policy debt.
• 14:48
  SPEAKER_01: Policy get yeah.
• 14:49
  SPEAKER_00: If a single GPO exceeds four megabytes of XML text, it means it is horribly bloated with thousands of registry payloads, massive custom preference strings, or just decades of conflicting junk.
• 15:00
  SPEAKER_01: Oh, I see.
• 15:01
  SPEAKER_00: The parser rejects it because a policy that massive will almost certainly crash the modern MDM sync engine on the endpoint.
• 15:07
  SPEAKER_01: It's digital minimalism enforced by code.
• 15:09
  SPEAKER_00: Yeah.
• 15:09
  SPEAKER_01: It's Microsoft saying, we refuse to import your 15 years of garbage.
• 15:13
  SPEAKER_01: Break it down.
• 15:14
  SPEAKER_00: Exactly.
• 15:14
  SPEAKER_00: The admin is forced to go back on premises, dissect that monolithic GPO into logical bite-sized policies, maybe separate the browser settings from the firewall settings, export them individually, and try again.
• 15:26
  SPEAKER_01: And even if you get the size right, you can still fail on encoding.
• 15:29
  SPEAKER_00: Yes.
• 15:29
  SPEAKER_00: The XML file must be saved using strict UTF-8 or UTF-16 Unicode encoding.
• 15:35
  SPEAKER_00: If a legacy domain controller generates the report with incorrect ANSI encoding, the Intune parser throws a fatal error.
• 15:43
  SPEAKER_01: And the most shocking limitation for multinational organizations, the parser currently only supports group policy settings defined in the English language.
• 15:51
  SPEAKER_00: Yeah, this is a major structural limitation.
• 15:53
  SPEAKER_00: The translation engine relies on structural mapping and rejects patterns that are tightly bound to the English ADMX templates.
• 16:00
  SPEAKER_01: So if you aren't using English.
• 16:17
  SPEAKER_01: Okay.
• 16:17
  SPEAKER_01: Let's assume the admin navigates the file size, the encoding, and the language barriers perfectly.
• 16:22
  SPEAKER_01: They upload the XML into group policy analytics.
• 16:25
  SPEAKER_01: What is the engine actually doing behind the scenes?
• 16:27
  SPEAKER_00: It acts as a massive dictionary translation engine.
• 16:30
  SPEAKER_00: It reads the on-premises registry paths embedded in the XML and attempts to match them against the native Windows configuration service providers.
• 16:38
  SPEAKER_01: It's looking for a one-to-one mapping.
• 16:40
  SPEAKER_01: If the GPO says disable camera, it searches the CSP dictionary for the exact OMA URI address that disables the camera.
• 16:47
  SPEAKER_00: Correct.
• 16:48
  SPEAKER_00: It evaluates across primary native CSPs.
• 16:51
  SPEAKER_00: For example, it checks the policy CSP for standard OS templates, the BitLocker CSP for drive encryption parameters, and the Passport Forwork CSP for Windows Hello biometric configurations.
• 17:02
  SPEAKER_01: When it finds a perfect match, it's a beautiful thing.
• 17:04
  SPEAKER_01: The portal gives you an MDM support status of yes, and it spits out the exact map CSP name and the precise OMA URI path.
• 17:12
  SPEAKER_01: Like a legacy bitlocker GPO cleanly translates to device vendor MSFT BitLocker required device encryption.
• 17:18
  SPEAKER_01: You click migrate and you are done.
• 17:20
  SPEAKER_00: But that is the absolute best case scenario.
• 17:23
  SPEAKER_00: We have to be brutally honest about what does not map cleanly across this gap because this is where migrations stall for months.
• 17:30
  SPEAKER_01: Let's get into the wreckage then.
• 17:32
  SPEAKER_01: What is the biggest casualty of the translation gap?
• 17:34
  SPEAKER_01: What just outright fails?
• 17:36
  SPEAKER_00: Without question.
• 17:37
  SPEAKER_00: WMI filters, Windows Management Instrumentation Filters.
• 17:40
  SPEAKER_01: I see infrastructure engineers tear their hair out over this.
• 17:43
  SPEAKER_01: Why do WMI filters completely fail to translate?
• 17:47
  SPEAKER_00: You have to look at the engineering reality of how a WMI filter actually operates.
• 17:51
  SPEAKER_00: In the legacy on-premises world, a WMI filter runs a synchronous query against the local hardware right before applying a policy.
• 17:59
  SPEAKER_00: Right.
• 17:59
  SPEAKER_00: An admin might write a filter that says only apply this GPO if the machine's local chassis type equals laptop, and the OS build is exactly 19045.
• 18:09
  SPEAKER_01: It's a dynamic logic gate.
• 18:11
  SPEAKER_00: Yes.
• 18:11
  SPEAKER_00: But that logic gate requires the group policy client service to execute a local WMI query, parse the result, and then communicate back to the domain controller in real time to pull the payload.
• 18:22
  SPEAKER_01: Which you can't do over the internet.
• 18:24
  SPEAKER_00: Exactly.
• 18:24
  SPEAKER_00: In the cloud, Intune's sync engine does not support dynamic pre-evaluation hardware queries in that manner for configuration profiles.
• 18:32
  SPEAKER_00: There is no Intune equivalent for legacy WMI filters.
• 18:36
  SPEAKER_00: They are completely dropped during the analytics import.
• 18:38
  SPEAKER_01: Aaron Powell So if your entire hospital security strategy was built on complex WMI filtering, maybe targeting specific nursing stations based on local hardware identifiers, you are entirely out of luck.
• 18:52
  SPEAKER_00: You're starting from scratch.
• 18:54
  SPEAKER_01: You have to go back to the drawing board and figure out how to use intra-ID dynamic device groups instead, which is a totally different skill set.
• 19:00
  SPEAKER_00: Completely different.
• 19:01
  SPEAKER_00: And the pain doesn't stop there.
• 19:03
  SPEAKER_00: Advanced Windows firewall rules and complex app locker configurations often show up as grayed out or unsupported during the standard migration phase.
• 19:11
  SPEAKER_01: Wait, why?
• 19:12
  SPEAKER_01: Windows still have a firewall and Intune manages Windows.
• 19:15
  SPEAKER_01: Why wouldn't a firewall rule translate through the standard catalog?
• 19:19
  SPEAKER_00: Because Intune intentionally isolates complex security workloads.
• 19:23
  SPEAKER_00: Microsoft doesn't want you migrating legacy spaghetti code firewall rules through a standard generic settings catalog import.
• 19:31
  SPEAKER_01: Oh, that makes sense.
• 19:32
  SPEAKER_00: Yeah.
• 19:32
  SPEAKER_00: Migrating thousands of obsolete port exceptions from 2012 is a massive security risk.
• 19:37
  SPEAKER_00: Those workloads require specialized isolation.
• 19:40
  SPEAKER_00: They must be manually audited, rewritten, and deployed using the dedicated endpoint security node in the Intune portal.
• 19:47
  SPEAKER_01: The dedicated node.
• 19:48
  SPEAKER_01: Why is the architecture forcing admins into a separate section of the portal just for security?
• 19:53
  SPEAKER_00: Fidelity and telemetry.
• 19:55
  SPEAKER_00: Intune needs deep granular visibility into security workloads to feed that conditional access engine we discussed earlier.
• 20:02
  SPEAKER_01: Right, the radar gun.
• 20:03
  SPEAKER_00: Exactly.
• 20:04
  SPEAKER_00: Translating legacy GPO blobs doesn't provide the reporting fidelity required for conditional access decisions.
• 20:09
  SPEAKER_00: The endpoint security node provides standardized logging and conflict resolution that a generic imported OMA URI simply cannot match.
• 20:18
  SPEAKER_01: So the translation gap is actively forcing you to become a better administrator.
• 20:21
  SPEAKER_01: It's forcing you into baseline consolidation.
• 20:24
  SPEAKER_00: Exactly.
• 20:25
  SPEAKER_00: Just because a setting gets a 100% compatibility score doesn't mean the policy is actually good.
• 20:30
  SPEAKER_00: A perfect score might just mean you successfully migrated a terrible, obsolete setting that degrades the modern OS experience.
• 20:37
  SPEAKER_01: Aaron Powell You're just migrating bad habits.
• 20:39
  SPEAKER_00: Right.
• 20:39
  SPEAKER_00: You have to undergo a formal rationalization process against native Intune endpoint security baselines.
• 20:46
  SPEAKER_01: Aaron Powell Let's paint a picture of how bad it gets if you don't consolidate.
• 20:49
  SPEAKER_01: Say an admin imports a legacy local security option, some random GPO that disables a legacy authentication protocol.
• 20:57
  SPEAKER_01: But then they also apply a modern Intune Microsoft recommended security baseline to that same device.
• 21:04
  SPEAKER_00: Aaron Powell You have just created a nightmare on the endpoint.
• 21:07
  SPEAKER_00: If the imported GPO and the modern baseline both attempt to manage the same underlying Windows setting through different CSP paths or with different string values, those overlapping configurations will clash.
• 21:18
  SPEAKER_01: And what happens to the machine?
• 21:20
  SPEAKER_00: The local MDM client doesn't know which one to trust.
• 21:23
  SPEAKER_00: It generates persistent conflict errors, the device is flagged as noncompliant, and the user gets locked out of their accounts because of conditional access.
• 21:30
  SPEAKER_01: Aaron Powell It's administrative self-sabotage.
• 21:32
  SPEAKER_01: You also have to deal with scope realignment, right?
• 21:34
  SPEAKER_01: We talked about user scope, the HKCU versus device scope, the HKLM.
• 21:38
  SPEAKER_01: The old Active Directory world, admins were lazy.
• 21:41
  SPEAKER_01: They would throw user configurations and computer configurations into one massive GPO bucket.
• 21:45
  SPEAKER_00: Aaron Powell It was incredibly common.
• 21:47
  SPEAKER_00: Just dump everything into one policy.
• 21:49
  SPEAKER_00: But in a tune, the settings catalog strictly enforces scope separation.
• 21:53
  SPEAKER_01: Aaron Powell So what does the admin have to do?
• 21:55
  SPEAKER_00: Administrators must manually open those consolidated legacy reports and painstaking.
• 22:00
  SPEAKER_00: Split them apart.
• 22:01
  SPEAKER_00: They have to target the user settings, like OneDrive sync restrictions, strictly to enter ID user security groups.
• 22:09
  SPEAKER_00: And they must target the device configurations, like BitLocker enforcement, strictly to enter ID device security groups.
• 22:17
  SPEAKER_01: You are basically untangling a giant knot of Christmas lights before you can plug them into the new house.
• 22:22
  SPEAKER_00: That's a perfect analogy.
• 22:24
  SPEAKER_01: Okay, so we've covered the native window settings, the baselines, the firewall rules, and WMI filters.
• 22:29
  SPEAKER_01: But what about everything else?
• 22:30
  SPEAKER_01: A hospital doesn't just run Windows, it runs specialized third-party applications, enterprise PDF readers, secure browsers, custom medical imaging software.
• 22:40
  SPEAKER_01: How do you manage the policy for third-party apps if they aren't native to the OS and don't have built-in CSPs?
• 22:45
  SPEAKER_00: This is where we get into the heavy lifting.
• 22:47
  SPEAKER_00: Custom ADMX ingestion.
• 22:57
  SPEAKER_01: How does Intune handle them?
• 22:58
  SPEAKER_00: You have to manually upload those third-party templates into the Intune tenant.
• 23:03
  SPEAKER_00: But because Intune is a multi-tenant cloud environment processing millions of policy syncs a minute, it cannot dynamically compile infinite custom schemas on the fly.
• 23:13
  SPEAKER_00: Therefore, the ingestion rules are incredibly strict.
• 23:16
  SPEAKER_01: Aaron Powell I imagine you can't just drag and drop a massive zip file of all your vendor templates.
• 23:20
  SPEAKER_00: Aaron Powell Not even close.
• 23:21
  SPEAKER_00: First, you must upload the core.addmx file, which contains the language neutral registry schema, but you also have to upload the associated localized language.dms will simultaneously.
• 23:31
  SPEAKER_01: At the exact same time.
• 23:32
  SPEAKER_00: Yes.
• 23:33
  SPEAKER_00: If you miss the language file, the parser fails immediately.
• 23:35
  SPEAKER_01: Aaron Powell And there are severe size limitations here.
• 23:37
  SPEAKER_00: A hard one megabyte file size limit per ADMX file and a global tenant limit of a maximum of 20 custom ADMX files total.
• 23:45
  SPEAKER_01: Aaron Powell Wait, only 20 files.
• 23:47
  SPEAKER_01: For an entire enterprise, that means you can't manage every single minor utility.
• 23:52
  SPEAKER_01: You have to ruthlessly prioritize which third-party apps actually require cloud management.
• 23:57
  SPEAKER_00: Yes.
• 23:58
  SPEAKER_00: But the size and file limits aren't even the hardest part.
• 24:01
  SPEAKER_00: The most complex engineering hurdle of custom ADMX ingestion is managing the dependency chains.
• 24:07
  SPEAKER_01: Dependency chains.
• 24:08
  SPEAKER_01: So one template requires another template to exist before it can compile.
• 24:12
  SPEAKER_00: Exactly.
• 24:12
  SPEAKER_00: If an ADMX file relies on a parent namespace defined in a different file, the parent file must be imported and successfully parsed first.
• 24:20
  SPEAKER_00: The classic, most painful example of this is Google Chrome.
• 24:24
  SPEAKER_01: Let's walk through the Chrome deployment scenario, because practically every organization struggles with this.
• 24:29
  SPEAKER_00: So Google provides an administrative template specifically for managing the Chrome browser, which is Chrome.admxes.
• 24:36
  SPEAKER_00: But the internal schema of that template relies entirely on a root namespace template called Google.addemxx, which defines the overarching Google software registry keys.
• 24:46
  SPEAKER_01: So if an admin goes into the Intune portal and uploads Chrome.addemx first, because that's the app they care about.
• 24:52
  SPEAKER_00: The Intune backend parser attempts to compile the schema, realizes the root namespace is missing, throws a validation error, and fails the entire upload.
• 25:01
  SPEAKER_01: So they have to start over.
• 25:02
  SPEAKER_00: The admin has to manually upload Google.addMX, wait for the cloud infrastructure to fully process and compile it into the tenant schema, and only then can they upload Chrome.addMX.
• 25:13
  SPEAKER_01: It requires meticulous sequencing, but the engineering constraint that really fascinates me is what happens after the template is successfully uploaded and deployed, the concept of in-use locking.
• 25:25
  SPEAKER_00: This is a critical safety mindenism of modern cloud architecture.
• 25:28
  SPEAKER_00: Once you successfully upload a custom ADMX template and you use it in an active Intune configuration profile, say you push a policy setting, the Chrome homepage, the underlying ADMX template is permanently locked in the portal.
• 25:41
  SPEAKER_01: Locked meaning what?
• 25:42
  SPEAKER_01: What if Google releases a critical update to Chrome that requires a brand new policy setting, so they issue a new ADMX file?
• 25:49
  SPEAKER_00: You cannot modify, update, or overwrite that locked ADMX template.
• 25:53
  SPEAKER_00: The cloud backend prevents it.
• 25:54
  SPEAKER_00: Because if you corrupt or change the underlying schema while thousands of live endpoint devices are actively trying to read and evaluate their current configuration profiles against it, you could blue screen endpoints or break the sync engine entirely.
• 26:09
  SPEAKER_01: So how do you update it if it's locked?
• 26:11
  SPEAKER_00: You have to completely tear down the active deployment.
• 26:14
  SPEAKER_00: You must delete every single configuration profile in your Intune tenant that references that specific template, wait for the deletion to sync across your entire fleet, delete the old ADMX file, upload the new ADMX file, and then completely rebuild your configuration profiles from scratch.
• 26:30
  SPEAKER_01: That is an administrative nightmare.
• 26:31
  SPEAKER_01: It requires absolute lifecycle management precision.
• 26:34
  SPEAKER_01: You can't just fly by the seat of your pants.
• 26:36
  SPEAKER_00: No, you really can't.
• 26:37
  SPEAKER_01: So we have this massive complex translation gap.
• 26:40
  SPEAKER_01: We are mapping to CSPs, dropping WMI filters, splitting scopes, rationalizing baselines, and delicately balancing custom ADMX dependency chains.
• 26:50
  SPEAKER_01: This process takes months.
• 26:52
  SPEAKER_01: What happens to the endpoints during this messy middle phase?
• 26:56
  SPEAKER_01: What happens to a hospital laptop that is still physically joined to the old on-premises domain, but is also enrolled in in tune and suddenly receives conflicting instructions from both systems?
• 27:05
  SPEAKER_00: That is the ultimate race condition.
• 27:07
  SPEAKER_00: If a device receives a legacy GPO from the local SYS VL saying disable Windows firewall, and simultaneously receives an Intune policy saying enable Windows Firewall, the local OS is caught in a tug of war.
• 27:20
  SPEAKER_01: And what does the machine do?
• 27:22
  SPEAKER_00: The resulting endpoint behavior is completely unpredictable.
• 27:24
  SPEAKER_00: It might toggle the setting back and forth every few minutes, burning CPU cycles and destroying the user experience.
• 27:29
  SPEAKER_01: You have to declare a winner.
• 27:30
  SPEAKER_01: How do you resolve the conflict?
• 27:32
  SPEAKER_00: Microsoft provides a specific critical policy CSP URI to handle this exact scenario.
• 27:37
  SPEAKER_00: It is called MDM WinsOver GP.
• 27:40
  SPEAKER_01: The name is literal.
• 27:41
  SPEAKER_01: How does it function under the hood?
• 27:42
  SPEAKER_00: It is an integer-based Boolean setting deployed from Intune.
• 27:46
  SPEAKER_00: If MDM Wins over GP is set to zero, which is the default unconfigured state, the OS attempts no conflict resolution.
• 27:53
  SPEAKER_00: You get the race condition.
• 27:55
  SPEAKER_00: Okay.
• 27:55
  SPEAKER_00: But if the Intune administrator deploys a policy setting MDM wins over GP to one, it rewrites the local policy evaluation hierarchy on the Windows client.
• 28:04
  SPEAKER_01: It essentially tells the local group policy client service to stand down.
• 28:07
  SPEAKER_00: Yes.
• 28:08
  SPEAKER_00: When set to one, the OS ensures that if an incoming MDM policy and a local GPO attempt to configure the exact same setting, the MDM policy acts as an active block against the legacy GPO.
• 28:19
  SPEAKER_00: The cloud is established as the absolute authority.
• 28:22
  SPEAKER_01: But I imagine there is a catch.
• 28:23
  SPEAKER_01: It can't be that easy.
• 28:24
  SPEAKER_00: There is a massive catch.
• 28:26
  SPEAKER_00: MDM Windsover GP only resolve conflicts if the corresponding MDM setting resides strictly within the core policy CSP.
• 28:32
  SPEAKER_01: Oh no.
• 28:33
  SPEAKER_00: Right.
• 28:33
  SPEAKER_00: It does not magically resolve conflicts for specialized security workloads like endpoint protection or custom ADMX ingested settings.
• 28:40
  SPEAKER_00: If you have overlapping complex firewall rules, MDM Windsover GP will not save you.
• 28:44
  SPEAKER_00: You will still crash the endpoint.
• 28:46
  SPEAKER_01: Which brings us to the ultimate realization of this transition.
• 28:49
  SPEAKER_01: Because this translation gap is so treacherous, and because conflict resolution is so fragile, an organization like our 5000 endpoint hospital cannot simply flip a switch overnight.
• 29:00
  SPEAKER_01: You cannot delete the active directory servers on a Friday and expect Intune to flawlessly manage a perfectly translated environment on Monday morning.
• 29:07
  SPEAKER_00: Attempting a hard cutover is operational suicide.
• 29:10
  SPEAKER_01: They need a phased, heavily controlled methodology to move authority from the legacy servers to the cloud one workload at a time without breaking the endpoints.
• 29:19
  SPEAKER_01: And that bridge, the architectural safety net for the entire transition, is co-management.
• 29:24
  SPEAKER_00: Co-management is the definitive bridge strategy.
• 29:28
  SPEAKER_00: It is a dual management architecture where a Windows device is explicitly managed by both the on-premises configuration manager, traditionally known as SCCM, and the cloud-based Intune service simultaneously.
• 29:40
  SPEAKER_01: It's like being a driving instructor in a dual control driver's ed car.
• 29:43
  SPEAKER_01: You don't just hand the teenager the keys and hope for the best.
• 29:46
  SPEAKER_01: SCCM is the seasoned instructor sitting in the passenger seat with their foot hovering over the brake.
• 29:52
  SPEAKER_01: You hand over steering to the cloud, but you keep control of the gas until the cloud proves it won't crash the car.
• 29:58
  SPEAKER_00: That is a perfect analogy.
• 30:00
  SPEAKER_00: The absolute authority remains safely anchored with the on-premises configuration manager.
• 30:05
  SPEAKER_00: The transition only happens when the IT administrator explicitly moves specific workload sliders within the SECM console over to Intune.
• 30:15
  SPEAKER_01: Let's dissect these workload sliders because understanding exactly what mechanical authority is being transferred is the difference between a successful migration and taking down the hospital.
• 30:23
  SPEAKER_01: Let's start with the first, most critical slider, compliance policies.
• 30:27
  SPEAKER_00: Moving the compliance policies slider to InTune tells the local SECM agent to stop being the primary auditor of device health.
• 30:34
  SPEAKER_00: InTune becomes the singular authority for defining the baseline rules.
• 30:38
  SPEAKER_00: And as we discussed, this integrates the device's compliance state directly into entra conditional access.
• 30:44
  SPEAKER_01: But wait, our hospital has highly complex, custom on-premises configuration baselines built in SECM over the last decade.
• 30:52
  SPEAKER_01: Deep registry checks, custom PowerShell script evaluations.
• 30:56
  SPEAKER_01: They aren't ready to rebuild all of that complex logic into in tune yet.
• 31:00
  SPEAKER_01: If they move the slider, do they just lose all that localized auditing?
• 31:04
  SPEAKER_00: This is where the elegance of commanagement architecture shines.
• 31:07
  SPEAKER_00: They do not lose them.
• 31:08
  SPEAKER_00: If explicitly configured, on-premises SCCM baselines can still be evaluated and injected into the cloud compliance signal.
• 31:16
  SPEAKER_01: How does that communication work?
• 31:17
  SPEAKER_00: There is a specific checkbox in the Configuration Manager console that states, evaluate this baseline as part of compliance policy assessment.
• 31:25
  SPEAKER_00: If checked, the local SCCM agent continues to run its complex custom PowerShell checks on the local hardware.
• 31:32
  SPEAKER_00: It then generates a simple pass or fail binary result and sends that localized result up to Intune.
• 31:37
  SPEAKER_00: Intune then uses that local result as one of the criteria to determine the overall cloud compliance state for conditional access blocking.
• 31:44
  SPEAKER_01: It's brilliant.
• 31:45
  SPEAKER_01: You get the raw enforcement power of the cloud, but you retain the hyper-customized auditing logic of your on-prem servers.
• 31:53
  SPEAKER_01: Okay, what about the next workload slider?
• 31:56
  SPEAKER_01: Windows update policies.
• 31:58
  SPEAKER_00: Moving the slider shifts the authority for update scheduling, feature update deferrals, and patch deployment from local servers to Windows Update for Business, strictly controlled by Intune.
• 32:08
  SPEAKER_00: But there is a massive operational trap here that catches thousands of admins off guard.
• 32:13
  SPEAKER_01: What is the trap?
• 32:14
  SPEAKER_00: When you slide the Windows Update workload to Intune, you must manually go into the configuration manager client settings and explicitly disable the local software update workflow, the WSUS integration.
• 32:25
  SPEAKER_01: Why?
• 32:26
  SPEAKER_01: What is happening on the endpoint if you forget to turn WSUS off?
• 32:29
  SPEAKER_00: You trigger a devastating looping conflict.
• 32:32
  SPEAKER_00: Intoon tells the Windows endpoint, go to the internet and download the latest patch directly from Microsoft.
• 32:37
  SPEAKER_00: The device starts the download.
• 32:38
  SPEAKER_00: But then the local SCCM agent wakes up, sees its active WSUS policy, and says, no, stop that internet download.
• 32:45
  SPEAKER_00: You must scan against the local WSUS server.
• 32:47
  SPEAKER_00: It kills the cloud download.
• 32:49
  SPEAKER_00: Intune sees the failure and triggers the download again.
• 32:52
  SPEAKER_00: SCCM kills it again.
• 32:53
  SPEAKER_01: The CPU spikes, the network card is saturated, and the device never actually patches.
• 32:58
  SPEAKER_00: Exactly.
• 32:59
  SPEAKER_00: Disabling the local update workflow in SCCM is a strict architectural prerequisite.
• 33:05
  SPEAKER_00: And notably, completing the specific slider transition is also the mandatory prerequisite if the organization wants to utilize Windows Auto Patch.
• 33:14
  SPEAKER_01: Okay, the conflict resolution there is vital.
• 33:16
  SPEAKER_01: Let's look at the next one.
• 33:17
  SPEAKER_01: Device configuration.
• 33:19
  SPEAKER_01: This seems like the main event.
• 33:20
  SPEAKER_00: It is the heaviest lift.
• 33:22
  SPEAKER_00: Moving the device configuration slider transitions, standard operational policies, VPN profiles, Wi-Fi networks, certificate deployments from legacy GPOs over to Intune Settings Catalog.
• 33:34
  SPEAKER_00: But there is a hidden structural mandate built into this slider.
• 33:38
  SPEAKER_00: Moving device configuration automatically drags two other distinct workloads with it.
• 33:42
  SPEAKER_01: It forces other sliders to move against your will.
• 33:44
  SPEAKER_01: Which ones?
• 33:45
  SPEAKER_00: It automatically forces the transition of both the resource access and endpoint protection workloads.
• 33:50
  SPEAKER_00: You cannot move basic device configuration to the cloud without surrendering those security workloads as well.
• 33:56
  SPEAKER_01: That is a massive gotcha for a staged migration.
• 33:59
  SPEAKER_01: If the hospital admin just wants to start managing the Wi-Fi network from the cloud, they suddenly realize they're now forced to manage their entire antivirus posture from the cloud simultaneously.
• 34:09
  SPEAKER_00: Yes.
• 34:10
  SPEAKER_00: Because endpoint protection covers the entire Microsoft Defender Security Suite antivirus, local firewall, and bitlocker encryption.
• 34:18
  SPEAKER_00: The settings are too deeply intertwined with core device configuration to split the authority.
• 34:23
  SPEAKER_00: And there is a vital nuance here.
• 34:25
  SPEAKER_00: Once endpoint protection moves to in tune via co-management, Defender Antivirus must be managed via that unified endpoint security node we discussed earlier.
• 34:34
  SPEAKER_00: You can no longer rely on standard restriction profiles.
• 34:36
  SPEAKER_01: It forces you into the modern security paradigm, whether you are ready or not.
• 34:40
  SPEAKER_01: Okay, what about the Office Click-to-Run apps slider?
• 34:43
  SPEAKER_00: Transitioning this workload strips SCCM of its ability to manage Microsoft 365 apps.
• 34:48
  SPEAKER_00: The management of Office deployments and channel updates moves entirely to Intune.
• 34:52
  SPEAKER_01: What is the immediate physical impact on the local network?
• 34:55
  SPEAKER_00: It actively blocks local SCCM deployments of Microsoft 365.
• 35:00
  SPEAKER_00: If you have an Office deployment package sitting on a local server, the local client will evaluate it and intentionally fail the global deployment conditions.
• 35:08
  SPEAKER_00: From that moment on, all Office channel updates are pulled directly from the Office Content Delivery Network in the cloud.
• 35:14
  SPEAKER_00: You cannot install office suites from your on-premises distribution points anymore for those targeted devices.
• 35:20
  SPEAKER_01: Which saves local server storage but massively impacts internet bandwidth, which perfectly segues into the final and arguably most terrifying slider for large enterprises, client apps.
• 35:30
  SPEAKER_00: This is the most complex transition.
• 35:32
  SPEAKER_00: Moving the client apps workload allows Intune to deploy Win32 applications standard enterprise software directly to the device, working alongside SCCM.
• 35:41
  SPEAKER_01: Let's bring this back to the hospital.
• 35:43
  SPEAKER_01: They have a massive 5 gigabyte custom medical imaging application, like an AutoCAD equivalent for MRI scans.
• 35:51
  SPEAKER_01: They need to deploy this to 2,000 workstations.
• 35:54
  SPEAKER_01: If they move the client app slider to Intune, they don't want 2,000 laptops simultaneously hitting the public internet to download a 5 gigabyte file.
• 36:03
  SPEAKER_01: It would instantly melt the hospital's external firewall.
• 36:06
  SPEAKER_01: Under the old model, they used local SCCM distribution points.
• 36:10
  SPEAKER_01: Are those useless now?
• 36:12
  SPEAKER_00: They are not useless, but their function changes through a feature called Microsoft Connected Cache or MCC.
• 36:18
  SPEAKER_00: You can enable MCC on your existing local configuration manager distribution points.
• 36:22
  SPEAKER_00: When enabled, the Intune Cloud directs the local client to check the local MCC server on the LAN first.
• 36:28
  SPEAKER_00: If the 5GB payload is there, it downloads it locally.
• 36:31
  SPEAKER_00: If not, the server fetches it from the internet once, caches it, and serves it to the rest of the local network.
• 36:36
  SPEAKER_01: That's only the perfect solution.
• 36:37
  SPEAKER_01: What is the engineering catch?
• 36:39
  SPEAKER_00: The catch is that hosting cloud provision Win32 apps via a local connected cache introduces incredibly strict secure transport and trust requirements.
• 36:48
  SPEAKER_00: You cannot have unauthenticated local servers distributing cloud payloads.
• 36:52
  SPEAKER_00: Microsoft strictly enforces HTTPS for all Win32 application content downloads through MCC.
• 36:58
  SPEAKER_01: So the days of unencrypted HTTP traffic over the local network for software installs are completely over.
• 37:05
  SPEAKER_00: And the cryptographic prerequisites are rigid.
• 37:08
  SPEAKER_00: First, certificate authority trust.
• 37:10
  SPEAKER_00: The IC web server HTTPS binding on that local distribution point must use an SSL certificate issued by a trusted enterprise certification authority or a fully trusted public CA.
• 37:21
  SPEAKER_01: You can't just generate a quick self-signed certificate on the server to get the green check mark and make it work.
• 37:25
  SPEAKER_00: Absolutely not.
• 37:27
  SPEAKER_00: The modern Intune client will instantly detect a self-signed certificate, refuse to authenticate the cache server, and outright reject the payload to prevent a local man-in-the-middle attack.
• 37:38
  SPEAKER_00: Second is strict client trust alignment.
• 37:40
  SPEAKER_00: Every single hospital workstation must have the route and intermediate certificates of the CA that issued the distribution point certificate actively installed in its local trust store.
• 37:50
  SPEAKER_01: And what about the network routing?
• 37:52
  SPEAKER_01: How does the client know which local server to talk to?
• 37:55
  SPEAKER_00: You need flawlessly defined configuration manager boundary groups.
• 37:59
  SPEAKER_00: The client device must evaluate its current IP address, recognize it resides within a specific defined boundary group, and that boundary group must have that specific connected cache-enabled distribution point configured as a local site resource.
• 38:12
  SPEAKER_00: If the boundary groups are misconfigured by even a single subnet, the client ignores the local cache entirely and goes straight to the internet, melting the firewall anyway.
• 38:21
  SPEAKER_01: That is an overwhelming amount of moving parts.
• 38:23
  SPEAKER_01: Cryptographic certificates, rigid boundary groups, hidden slider dependencies, WSUS conflicts.
• 38:30
  SPEAKER_01: When an IT admin actually executes this co-management transition when they click apply on that slider, how do they actually prove it's working?
• 38:37
  SPEAKER_01: You can't just stare at the cloud portal and wait for a progress bar.
• 38:40
  SPEAKER_00: Never trust the cloud portal interface for real-time validation.
• 38:44
  SPEAKER_00: The graphical interface can have a massive synchronization delay.
• 38:47
  SPEAKER_00: Validation requires diving into the exact client-side telemetry logs on the Windows endpoint itself.
• 38:54
  SPEAKER_00: If a doctor calls the help desk because they can't access patient records after a transition, you don't look at Intune, you interrogate the local machine.
• 39:02
  SPEAKER_01: Walk us through troubleshooting scenario.
• 39:04
  SPEAKER_01: What specific logs are they hunting for?
• 39:07
  SPEAKER_00: It depends entirely on which workload slider you are diagnosing.
• 39:10
  SPEAKER_00: If you are validating the compliance policy shift, say the doctor is being blocked by conditional access, you open compliance handler.log on the endpoint.
• 39:18
  SPEAKER_00: This log will explicitly show if the local SCCM baseline successfully passed its check to the cloud.
• 39:24
  SPEAKER_01: And if they are investigating that CPU spunking WSUS conflict we talked about?
• 39:28
  SPEAKER_00: To verify that Windows updates are being correctly managed by Intune and that the WSUS conflict has been successfully suppressed, you investigate WEAHANLE.log.
• 39:39
  SPEAKER_00: It will show the exact authority the Windows update agent is yielding to.
• 39:43
  SPEAKER_01: And for the overarching configuration shift, the OMA URI is actually applying.
• 39:48
  SPEAKER_00: To verify that the CSPs are actively applying to the registry instead of the legacy GPOs, you interrogate the policy platform client.log.
• 39:57
  SPEAKER_00: This log exposes the raw API conversation between the Intune Sync engine and the local configuration service providers.
• 40:04
  SPEAKER_00: The logs do not lie.
• 40:06
  SPEAKER_00: They provide the ground truth of the structural transition.
• 40:09
  SPEAKER_01: When an organization removes on-premises Active Directory, group policy is permanently replaced by Microsoft Intune's settings catalog and configuration profiles, requiring a meticulous translation of legacy XML exports into cloud native OMMA URIs.
• 40:22
  SPEAKER_01: This transition is managed safely through co-management, allowing workload authority to be incrementally shifted from configuration manager to the cloud until legacy servers are decommissioned.
• 40:32
  SPEAKER_01: That's a wrap on what actually breaks when you migrate GPOs.
• 40:37
  SPEAKER_01: We closed on the safety net that makes this survivable.
• 40:40
  SPEAKER_01: Co-management.
• 40:41
  SPEAKER_01: You don't have to translate 2,000 GPOs before you start.
• 40:44
  SPEAKER_01: You move one workload slider at a time, watching for hidden dependencies like device configuration dragging endpoint protection with it, until configuration manager can finally be retired.
• 40:57
  SPEAKER_01: Next episode.
• 40:58
  SPEAKER_01: What goes wrong in that translation that nobody notices until it's too late?
• 41:03
  SPEAKER_01: The silent killer of Active Directory Removal.
• 41:06
  SPEAKER_01: Connect with Ernie on LinkedIn.
• 41:08
  SPEAKER_01: The links in the episode description.
• 41:10
  SPEAKER_01: Subscribe if this is useful.
• 41:12
  SPEAKER_01: Until next time.