Book 05 — Devices & Endpoints

Group Policy to Intune and Azure Arc: why the policy model can’t move as it is, what replaces it, who owns the endpoint, and how to migrate

Book 05 of the Modernization Workbook: why Group Policy can’t come to the cloud, the hybrid-join trap, where device and server data lives, Intune-first onboarding, the governed, manual and retrofit paths, who owns the endpoint, the GPO sunset program and policy migration, servers under Azure Arc, and operating and evidencing the fleet.

Book 05 — Devices & Endpoints: Group Policy to Intune and Azure Arc

Status — draft book

This book consolidates the workbook’s device and server modernization pages (the Group Policy sunset guides, the Intune policy migration guide, Intune-first onboarding, the Intune and Azure Arc path guides, the hybrid-join whitepaper and their short companion pages) into one ordered book. Every external claim was checked against a primary source on October 20, 2026 and carries a footnote. The earlier pages are kept in the repository’s archive/b05-devices/ folder, and their old addresses forward to the chapters that replaced them.

Download and present

b05-devices-bundle.docx: the whole book as one Word document, regenerated on every site deploy.

15-minute presentation: the Why / What / Who / How deck and its narrated, self-running version are in the repository under presentations/b05-devices/.

For twenty years Group Policy did a great deal of governance without anyone writing it down. Where a computer sat in the OU tree decided which settings it got, in which order, and which ones won. Moving devices to Entra ID and Intune removes that machinery. Nothing in the cloud reads the OU tree, and Intune applies policy by assignment, not by precedence. So the settings, the targeting and the exceptions all have to be stated again on purpose. Servers follow a different road: Intune doesn’t manage Windows Server, so servers come under governance through Azure Arc and Azure Policy. This book is the plan for both, and for the hybrid-join shortcut that looks like progress but isn’t an end state.

Why, what, who, how

	Question	Chapters
Why	Why can’t Group Policy come to the cloud, and why isn’t hybrid join the answer?	01, 02
What	What is authoritative for devices and servers, how new devices start governed, and which path each estate takes	03, 04, 05
Who	Who decides and who does the work for the endpoint	06
How	Sunset Group Policy, migrate the policy, bring servers under Arc, and run and evidence the fleet	07, 08, 09, 10

Appendix: A — GPO to Intune crosswalk

Reading paths

Executives (20 minutes): Chapters 01, 02 and 06, or the 15-minute presentation.
Architects: Chapters 01–06, then 09.
Endpoint and server engineers: Chapters 03–05, then 07–10 with Appendix A at hand.

Where this book sits in the workbook

This is Book 05 of the Modernization Workbook. It builds on Book 02 — Identity & Directory for the directory migration, and hands device compliance to Book 04 — Access & Privilege, where Conditional Access decides what a compliant device may reach. The Endpoint & Device Modernization project (plan) delivers it, and the Client-Server to Hybrid-Cloud chapters on policy and compute tell the same story at the level of the whole estate.

Chapters

Title	Description
Chapter 01 — Why Group Policy Can’t Come to the Cloud	What Group Policy did implicitly for a domain-joined fleet, why none of that machinery exists on an Entra-joined, Intune-managed device, and the governance gaps the move opens unless they are rebuilt on purpose.
Chapter 02 — The Hybrid Join Trap	Why converting a large domain-joined fleet to Microsoft Entra hybrid join is close to a tenant-wide switch, what an ungoverned flip spends in ownership, lifecycle and evidence, why Microsoft treats hybrid join as a waypoint rather than a destination, and how a governed path reaches the same end state.
Chapter 03 — Where Device and Server Data Lives	Which system is authoritative for each fact about a device or server (procurement and CMDB records, Microsoft Entra ID device objects, Intune records, Windows Autopilot registrations, Azure Arc resources and Defender for Endpoint), and the keys that correlate them.
Chapter 04 — Intune-First Onboarding	How net-new devices enter governance from day zero: the doctrine, the five-phase procure-to-validate process, Windows Autopilot and Autopilot device preparation, enrollment restrictions, naming, group tags, the Enrollment Status Page, compliance and configuration baselines, other platforms, exceptions and drift.
Chapter 05 — The Governed, Manual and Retrofit Paths	The three ways a workstation or server reaches the target state (governed, manual and retrofit), what each needs, produces and risks, the runbook they share, and how to choose between them.
Chapter 06 — Who Owns the Endpoint	Who decides, who does the work and who is consulted when workstations and servers move from Group Policy to Intune and Azure Arc, with a responsibility matrix and the Entra, Intune and Azure roles each team needs.
Chapter 07 — The GPO Sunset Program	The Group Policy sunset run as a program: inventory and parse, classify every setting, crosswalk, decide, sequence by population, freeze and disable links, and retire, with the coexistence rules and methodology principles that govern each step.
Chapter 08 — GPO to Intune Policy Migration	The technical side of the GPO sunset: seven phases with tasks, durations, gates, rings, testing and rollback, and the program’s library of Intune policy templates for compliance, configuration, endpoint security and app protection, with dynamic group templates and Microsoft Graph templates; the setting-level crosswalk is Appendix A.
Chapter 09 — Servers Under Azure Arc	How to bring on-premises servers under cloud governance with Azure Arc: the Connected Machine agent, onboarding methods, least-privilege service principals, Azure Policy machine configuration, Azure Update Manager, Defender for Servers, Extended Security Updates, Microsoft Entra ID sign-in, rollback, and the governed and manual server paths.
Chapter 10 — Operating and Evidencing the Fleet	Run-state for the Intune-managed fleet: compliance and the Conditional Access hand-off, Windows update rings and Windows Autopatch, Microsoft Defender for Endpoint, device inventory reconciliation, retirement and wipe, drift detection, and the evidence an assessor reads for NIST SP 800-53 CM-2, CM-6, CM-7, CM-8 and SI-2.
Appendix A — GPO to Intune Crosswalk	The Group Policy to Intune crosswalk: each GPO area mapped to its Intune mechanism with notes and limits, the program’s 50-row setting reference, the CSP paths behind key settings, and the workload-by-workload comparison.