July 17, 2026
SCCM vs Intune - Simply Explained
SCCM (System Center Configuration Manager), now officially known as Microsoft Endpoint Configuration Manager (MECM), and Microsoft Intune are two of Microsoft's most important endpoint management solutions. While both help IT teams deploy software, manage devices, enforce security policies, and keep endpoints updated, they were built for completely different eras of IT. SCCM was designed for traditional on-premises corporate networks where everything lived inside the company's data center. Intune was built for today's cloud-first world, where employees work remotely, devices connect from anywhere, and management happens over the internet. Understanding these differences is essential when planning a modern endpoint management strategy.
SCCM: THE ON-PREMISES POWERHOUSE
SCCM has been the enterprise standard for Windows device management for more than two decades. Running on infrastructure that organizations build and maintain themselves, SCCM provides extremely deep control over Windows desktops and servers. IT administrators can deploy operating systems using task sequences, distribute complex applications with dependencies, manage software updates through Windows Server Update Services (WSUS), inventory hardware and software, generate highly detailed reports, and automate large-scale deployments across thousands of devices. While incredibly powerful, SCCM requires significant infrastructure including SQL Server, site servers, management points, distribution points, and experienced administrators to keep everything running smoothly.
INTUNE: THE MODERN CLOUD-NATIVE APPROACH
Microsoft Intune takes a completely different approach by moving endpoint management into the Microsoft cloud. There are no management servers to install, no SQL databases to maintain, and no distribution points to configure. Devices simply enroll over the internet and receive applications, security policies, compliance rules, and updates directly from Microsoft. Intune supports Windows, macOS, iOS, and Android from a single administration portal, making it ideal for organizations with remote employees, hybrid work, Bring Your Own Device (BYOD) programs, and globally distributed teams. Deep integration with Microsoft Entra ID, Conditional Access, Microsoft Defender, Windows Autopilot, and Microsoft 365 makes Intune a central component of Microsoft's Zero Trust security strategy.
SCCM VS INTUNE: WHICH IS BETTER?
The answer depends entirely on your environment. SCCM provides unmatched control for complex Windows deployments, server management, operating system imaging, advanced reporting, and highly customized application deployments. Intune excels in cloud-native device management, mobile device management, automated provisioning with Windows Autopilot, and managing users wherever they work. Organizations that primarily operate on-premises with large Windows environments often continue relying on SCCM, while businesses embracing cloud computing and remote work increasingly choose Intune as their primary management platform. Rather than replacing one another, both products complement different management scenarios and organizational requirements.
CO-MANAGEMENT: THE BEST OF BOTH WORLDS
Microsoft understands that most enterprises cannot migrate overnight, which is why Co-Management allows SCCM and Intune to manage the same device simultaneously. Organizations can gradually move workloads such as compliance policies, Windows updates, endpoint protection, and device configuration from SCCM into Intune while continuing to use SCCM for operating system deployment, server management, or complex software installations. This phased migration reduces risk, protects existing investments, and allows IT departments to modernize at their own pace without disrupting users or rebuilding their entire management infrastructure in one project.
WHICH SOLUTION SHOULD YOUR ORGANIZATION CHOOSE?
For organizations with highly customized Windows environments, large on-premises infrastructures, and advanced deployment requirements, SCCM remains one of the most capable endpoint management platforms available. For businesses adopting hybrid work, cloud-first infrastructure, mobile devices, and Microsoft 365, Intune represents the future of endpoint management. Many enterprises ultimately use both through Co-Management, combining SCCM's mature deployment capabilities with Intune's cloud-native flexibility and security. As Microsoft continues investing heavily in Intune and cloud management, understanding how both solutions work together has become increasingly important for every IT professional responsible for managing modern workplace devices.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:02,560
Today's topic is one that almost everyone has heard of,
2
00:00:02,560 --> 00:00:03,880
but most people get wrong.
3
00:00:03,880 --> 00:00:05,800
I'm talking about SCCM and Intune.
4
00:00:05,800 --> 00:00:07,440
You've probably heard both names thrown around,
5
00:00:07,440 --> 00:00:08,960
and it's easy to assume they're basically
6
00:00:08,960 --> 00:00:10,640
the same tool with different names,
7
00:00:10,640 --> 00:00:13,320
two Microsoft products that both manage devices, right?
8
00:00:13,320 --> 00:00:14,720
Well, not exactly, actually,
9
00:00:14,720 --> 00:00:16,320
they're two very different tools
10
00:00:16,320 --> 00:00:18,160
with different strengths, different philosophies
11
00:00:18,160 --> 00:00:20,200
and different infrastructure requirements.
12
00:00:20,200 --> 00:00:22,200
And picking the wrong one means you could waste time
13
00:00:22,200 --> 00:00:24,440
and money on infrastructure you don't need
14
00:00:24,440 --> 00:00:26,480
or miss the control you actually want.
15
00:00:26,480 --> 00:00:27,480
By the end of this episode,
16
00:00:27,480 --> 00:00:29,680
you'll understand what each tool actually does,
17
00:00:29,680 --> 00:00:31,400
how they compare side by side
18
00:00:31,400 --> 00:00:33,640
and which one makes sense for your organization.
19
00:00:33,640 --> 00:00:35,880
So grab your coffee and let's dive in.
20
00:00:35,880 --> 00:00:38,600
The core problem, managing devices at scale.
21
00:00:38,600 --> 00:00:41,560
Let's start with the problem, both tools are trying to solve.
22
00:00:41,560 --> 00:00:43,240
If you only have five computers in your office,
23
00:00:43,240 --> 00:00:44,200
you don't need either one.
24
00:00:44,200 --> 00:00:46,560
You can walk over and install software, run updates
25
00:00:46,560 --> 00:00:48,720
and fix things yourself and that works fine.
26
00:00:48,720 --> 00:00:51,880
But what happens with 500 computers or 5,000 or 50,000?
27
00:00:51,880 --> 00:00:53,760
The manual approach stops working very quickly.
28
00:00:53,760 --> 00:00:55,800
You can't have IT staff walking to every desk
29
00:00:55,800 --> 00:00:57,280
to install a security patch
30
00:00:57,280 --> 00:00:59,040
and you can't check each machine one by one
31
00:00:59,040 --> 00:01:00,120
for the right antivirus.
32
00:01:00,120 --> 00:01:01,400
It just doesn't scale.
33
00:01:01,400 --> 00:01:04,640
20 years ago, this was a huge problem for large organizations.
34
00:01:04,640 --> 00:01:06,720
IT teams had to physically visit machines,
35
00:01:06,720 --> 00:01:10,080
install software from CDs and run updates one at a time.
36
00:01:10,080 --> 00:01:12,160
That was slow, expensive and error prone.
37
00:01:12,160 --> 00:01:14,920
Microsoft looked at this problem and built two solutions,
38
00:01:14,920 --> 00:01:16,720
one for the old world where everything lived
39
00:01:16,720 --> 00:01:18,960
in your own building on your own servers
40
00:01:18,960 --> 00:01:22,240
and one for the new world, where devices are everywhere,
41
00:01:22,240 --> 00:01:25,400
users work remotely and the cloud handles the heavy lifting
42
00:01:25,400 --> 00:01:27,760
the first is SCCM and the second is in tune.
43
00:01:27,760 --> 00:01:30,480
They solve the same core problem, but in completely different ways.
44
00:01:30,480 --> 00:01:32,160
So before we compare them head to head,
45
00:01:32,160 --> 00:01:35,240
we need to understand what each one actually is.
46
00:01:35,240 --> 00:01:37,680
What is SCCM, the on-premises powerhouse?
47
00:01:37,680 --> 00:01:41,000
SCCM stands for System Center Configuration Manager.
48
00:01:41,000 --> 00:01:42,200
Though you might also hear it called
49
00:01:42,200 --> 00:01:45,520
Microsoft Endpoint Configuration Manager or MECM for short.
50
00:01:45,520 --> 00:01:48,480
That's the new name, but most people still call it SCCM.
51
00:01:48,480 --> 00:01:49,920
Here's the simplest definition.
52
00:01:49,920 --> 00:01:53,240
SCCM is an on-premises tool that you run on your own servers
53
00:01:53,240 --> 00:01:55,280
inside your own building on your own network.
54
00:01:55,280 --> 00:01:57,720
It's software you install and maintain yourself
55
00:01:57,720 --> 00:01:59,560
and it's been the go-to for large enterprises
56
00:01:59,560 --> 00:02:00,880
for over two decades.
57
00:02:00,880 --> 00:02:03,960
SCCM works using what's called an agent-based model.
58
00:02:03,960 --> 00:02:05,640
A small piece of software gets installed
59
00:02:05,640 --> 00:02:07,520
on every device you want to manage
60
00:02:07,520 --> 00:02:11,400
and that agent reports back to the SCCM server receives commands
61
00:02:11,400 --> 00:02:12,640
and carries out tasks.
62
00:02:12,640 --> 00:02:15,760
It's like having a tiny IT assistant living on each computer,
63
00:02:15,760 --> 00:02:16,920
waiting for instructions.
64
00:02:16,920 --> 00:02:18,800
So what can SCCM actually do?
65
00:02:18,800 --> 00:02:19,800
A lot.
66
00:02:19,800 --> 00:02:21,720
First, operating system deployment.
67
00:02:21,720 --> 00:02:24,440
You can push out windows to hundreds of new machines at once,
68
00:02:24,440 --> 00:02:27,440
saving days of manual effort, then software distribution.
69
00:02:27,440 --> 00:02:29,440
Install applications like Office or Chrome
70
00:02:29,440 --> 00:02:32,600
across your entire organization from one central console.
71
00:02:32,600 --> 00:02:34,000
It also handles patch management
72
00:02:34,000 --> 00:02:35,920
so you can roll out security updates
73
00:02:35,920 --> 00:02:37,760
on a schedule during maintenance windows
74
00:02:37,760 --> 00:02:40,200
with full control over timing and targeting.
75
00:02:40,200 --> 00:02:41,840
Compliance reporting shows which machines
76
00:02:41,840 --> 00:02:44,000
meet your security standards and which don't.
77
00:02:44,000 --> 00:02:45,680
An inventory gives you a complete picture
78
00:02:45,680 --> 00:02:48,160
of hardware and software across your environment.
79
00:02:48,160 --> 00:02:49,960
Large enterprises have relied on this tool
80
00:02:49,960 --> 00:02:51,040
for more than 20 years.
81
00:02:51,040 --> 00:02:53,160
It's mature, powerful, and gives IT teams
82
00:02:53,160 --> 00:02:55,600
deep granular control over Windows devices.
83
00:02:55,600 --> 00:02:57,240
Need to deploy a complex application
84
00:02:57,240 --> 00:02:59,200
with dependencies and custom scripts?
85
00:02:59,200 --> 00:03:00,680
SCCM can handle it.
86
00:03:00,680 --> 00:03:02,320
Need to image a hundred new laptops
87
00:03:02,320 --> 00:03:04,240
with a custom operating system build?
88
00:03:04,240 --> 00:03:04,920
That too.
89
00:03:04,920 --> 00:03:05,760
But here's the thing.
90
00:03:05,760 --> 00:03:08,160
SCCM requires serious infrastructure.
91
00:03:08,160 --> 00:03:11,320
You need domain controllers, SQL servers, site servers,
92
00:03:11,320 --> 00:03:12,880
distribution points, management points,
93
00:03:12,880 --> 00:03:14,320
and people who know how to set it all up
94
00:03:14,320 --> 00:03:16,480
and keep it running is not something you just turn on
95
00:03:16,480 --> 00:03:17,560
and forget about.
96
00:03:17,560 --> 00:03:19,240
And that's where it sibling comes in.
97
00:03:19,240 --> 00:03:22,120
A tool from Microsoft that takes a completely different approach.
98
00:03:22,120 --> 00:03:25,040
One that doesn't need any of that infrastructure at all.
99
00:03:25,040 --> 00:03:25,880
What is Intune?
100
00:03:25,880 --> 00:03:27,600
The Cloud Native Modern Tool.
101
00:03:27,600 --> 00:03:29,680
Now let's talk about the other option, Intune.
102
00:03:29,680 --> 00:03:31,120
Here's the simplest definition.
103
00:03:31,120 --> 00:03:32,480
It's a cloud-based service.
104
00:03:32,480 --> 00:03:33,520
No service to buy.
105
00:03:33,520 --> 00:03:34,960
No infrastructure to maintain.
106
00:03:34,960 --> 00:03:36,600
No SQL databases to manage.
107
00:03:36,600 --> 00:03:39,120
Everything runs inside Microsoft's Azure Data Centers.
108
00:03:39,120 --> 00:03:41,840
You sign in through a web browser, configure your policies,
109
00:03:41,840 --> 00:03:42,640
and you're done.
110
00:03:42,640 --> 00:03:44,600
Instead of the agent-based model, Intune
111
00:03:44,600 --> 00:03:46,000
uses a profile-based model.
112
00:03:46,000 --> 00:03:47,880
Devices enroll directly with the service
113
00:03:47,880 --> 00:03:50,720
over the internet, receive policies and configurations,
114
00:03:50,720 --> 00:03:53,280
and check in periodically to report their status.
115
00:03:53,280 --> 00:03:54,920
No agent software to install.
116
00:03:54,920 --> 00:03:56,760
No management points to configure.
117
00:03:56,760 --> 00:03:58,840
The device talks directly to the cloud.
118
00:03:58,840 --> 00:04:00,280
That's a big difference in scope.
119
00:04:00,280 --> 00:04:02,360
SCCM is primarily a Windows tool.
120
00:04:02,360 --> 00:04:03,840
It can manage some other platforms,
121
00:04:03,840 --> 00:04:05,480
but it's hard and soul is Windows.
122
00:04:05,480 --> 00:04:08,120
Intune, on the other hand, supports Windows, Mac OS, iOS,
123
00:04:08,120 --> 00:04:08,960
and Android.
124
00:04:08,960 --> 00:04:10,920
So if you have a mixed environment with iPhones
125
00:04:10,920 --> 00:04:13,200
for executives, Android tablets for field workers,
126
00:04:13,200 --> 00:04:14,720
and MacBooks for the design team,
127
00:04:14,720 --> 00:04:17,400
Intune can manage all of them from the same console.
128
00:04:17,400 --> 00:04:18,960
So what can Intune actually do?
129
00:04:18,960 --> 00:04:20,760
It handles device enrollment, uses
130
00:04:20,760 --> 00:04:23,640
can join their own devices, or IT can pre-configure them.
131
00:04:23,640 --> 00:04:26,360
It handles application deployment to Windows, Mac, iOS,
132
00:04:26,360 --> 00:04:27,240
and Android.
133
00:04:27,240 --> 00:04:29,400
Conditional access policies require devices
134
00:04:29,400 --> 00:04:32,520
to be compliant before they can access company data.
135
00:04:32,520 --> 00:04:35,280
Compliance policies define what a healthy device looks like
136
00:04:35,280 --> 00:04:36,600
and generate reports.
137
00:04:36,600 --> 00:04:38,680
And Windows update rings, let patches roll out
138
00:04:38,680 --> 00:04:41,920
in a controlled way, without needing WS/US or on-premises
139
00:04:41,920 --> 00:04:42,800
infrastructure.
140
00:04:42,800 --> 00:04:45,800
This is the direction Microsoft is investing in for the future.
141
00:04:45,800 --> 00:04:48,000
Almost every new feature in endpoint management
142
00:04:48,000 --> 00:04:49,680
is being built for Intune first.
143
00:04:49,680 --> 00:04:52,080
The cloud native approach is where development resources are
144
00:04:52,080 --> 00:04:52,400
going.
145
00:04:52,400 --> 00:04:55,240
So we've got two tools that both manage devices, one runs
146
00:04:55,240 --> 00:04:57,360
on your servers with agents, the other runs in the cloud
147
00:04:57,360 --> 00:04:58,360
with profiles.
148
00:04:58,360 --> 00:05:00,160
They're fundamentally different under the hood,
149
00:05:00,160 --> 00:05:02,560
and we're going to dig into what that actually means.
150
00:05:02,560 --> 00:05:05,120
On-premises versus cloud, the big difference.
151
00:05:05,120 --> 00:05:07,440
Actually, the big difference between SCCM and Intune
152
00:05:07,440 --> 00:05:08,680
comes down to just one thing--
153
00:05:08,680 --> 00:05:09,480
infrastructure.
154
00:05:09,480 --> 00:05:10,800
SCCM needs a lot of it.
155
00:05:10,800 --> 00:05:13,040
You need domain controllers for authentication,
156
00:05:13,040 --> 00:05:15,800
SQL servers to host the site database, site servers
157
00:05:15,800 --> 00:05:18,320
to run the core management role, distribution points
158
00:05:18,320 --> 00:05:20,400
to host content that devices download,
159
00:05:20,400 --> 00:05:23,000
and management points for client communication.
160
00:05:23,000 --> 00:05:24,960
Each of these is a separate server--
161
00:05:24,960 --> 00:05:27,720
or multiple servers, or running Windows server,
162
00:05:27,720 --> 00:05:31,000
consuming licenses requiring patches, needing backups.
163
00:05:31,000 --> 00:05:33,840
Intune needs one thing, an internet connection.
164
00:05:33,840 --> 00:05:34,360
That's it.
165
00:05:34,360 --> 00:05:37,000
No servers, no SQL databases, no distribution points,
166
00:05:37,000 --> 00:05:38,120
no management points.
167
00:05:38,120 --> 00:05:40,720
The infrastructure is Microsoft's problem, not yours.
168
00:05:40,720 --> 00:05:43,640
This difference shows up in every part of how these tools work.
169
00:05:43,640 --> 00:05:45,200
Take deployment methods.
170
00:05:45,200 --> 00:05:47,440
In SCCM, deploying a new operating system
171
00:05:47,440 --> 00:05:49,800
to a computer typically involves PXC boot.
172
00:05:49,800 --> 00:05:51,320
The device boots from the network,
173
00:05:51,320 --> 00:05:52,800
connects to a distribution point,
174
00:05:52,800 --> 00:05:55,320
and runs a task sequence that partitions the drive,
175
00:05:55,320 --> 00:05:58,560
installs Windows, applies settings, and installs applications.
176
00:05:58,560 --> 00:06:00,280
It's powerful, but it requires the device
177
00:06:00,280 --> 00:06:02,040
to be on the corporate network connected
178
00:06:02,040 --> 00:06:03,200
to the right infrastructure.
179
00:06:03,200 --> 00:06:04,960
Intune takes a completely different approach
180
00:06:04,960 --> 00:06:06,440
with Windows autopilot.
181
00:06:06,440 --> 00:06:08,360
A new laptop arrives from the manufacturer,
182
00:06:08,360 --> 00:06:10,240
already registered in your tenant.
183
00:06:10,240 --> 00:06:12,600
The user turns it on, connects to Wi-Fi,
184
00:06:12,600 --> 00:06:14,840
and signs in with their work credentials.
185
00:06:14,840 --> 00:06:17,600
From there, Windows configures itself automatically,
186
00:06:17,600 --> 00:06:20,600
applications install from the cloud, and policies apply.
187
00:06:20,600 --> 00:06:22,960
The device is ready to use in minutes, no imaging,
188
00:06:22,960 --> 00:06:25,880
no PXC boot, and no IT staff needed.
189
00:06:25,880 --> 00:06:27,920
Update management follows the same pattern.
190
00:06:27,920 --> 00:06:32,360
SCCM integrates with WSUS, Windows Server Update Services,
191
00:06:32,360 --> 00:06:34,280
to download and approve patches.
192
00:06:34,280 --> 00:06:35,520
You configure maintenance Windows,
193
00:06:35,520 --> 00:06:37,520
create deployment packages, target collections,
194
00:06:37,520 --> 00:06:38,560
and monitor compliance.
195
00:06:38,560 --> 00:06:41,920
It gives you deep control, but there are a lot of moving parts.
196
00:06:41,920 --> 00:06:44,320
Intune uses Windows Update for business.
197
00:06:44,320 --> 00:06:46,600
You create update rings, groups of devices
198
00:06:46,600 --> 00:06:48,600
with the same update settings, and decide
199
00:06:48,600 --> 00:06:51,360
how fast updates roll out when deadlines happen,
200
00:06:51,360 --> 00:06:53,440
and what features to defer.
201
00:06:53,440 --> 00:06:55,920
Devices check directly with Microsoft's update servers,
202
00:06:55,920 --> 00:06:58,520
no WSUS, no distribution points, no maintenance
203
00:06:58,520 --> 00:07:00,800
windows to configure, and security integration
204
00:07:00,800 --> 00:07:02,320
follows the same split.
205
00:07:02,320 --> 00:07:04,640
Intune connects natively with Azure Active Directory
206
00:07:04,640 --> 00:07:06,000
and conditional access.
207
00:07:06,000 --> 00:07:07,720
The device reports its compliance status.
208
00:07:07,720 --> 00:07:09,800
If it's not compliant, missing an update,
209
00:07:09,800 --> 00:07:11,960
no encryption, outdated antivirus,
210
00:07:11,960 --> 00:07:14,520
conditional access can block it from accessing email teams
211
00:07:14,520 --> 00:07:15,680
or SharePoint.
212
00:07:15,680 --> 00:07:17,560
It happens automatically in real time,
213
00:07:17,560 --> 00:07:20,000
without any on-premises infrastructure.
214
00:07:20,000 --> 00:07:22,080
SCCM has its own compliance engine.
215
00:07:22,080 --> 00:07:25,400
It can evaluate policies, generate reports, and remediate issues,
216
00:07:25,400 --> 00:07:27,280
but it doesn't integrate as seamlessly
217
00:07:27,280 --> 00:07:29,520
with cloud identity and access controls.
218
00:07:29,520 --> 00:07:32,160
You can make it work, but it takes more effort and more pieces.
219
00:07:32,160 --> 00:07:33,680
These differences aren't abstract.
220
00:07:33,680 --> 00:07:36,280
They matter depending on what you're actually trying to do.
221
00:07:36,280 --> 00:07:38,320
If your workforce is in one building,
222
00:07:38,320 --> 00:07:41,160
on the corporate network, with standardized Windows Desktops,
223
00:07:41,160 --> 00:07:43,680
SCCM's depth might be exactly what you need.
224
00:07:43,680 --> 00:07:46,080
But if your workforce is spread across the country,
225
00:07:46,080 --> 00:07:48,120
working from home on a mix of devices,
226
00:07:48,120 --> 00:07:50,320
Intune's cloud native approach starts to look
227
00:07:50,320 --> 00:07:51,960
a lot more practical.
228
00:07:51,960 --> 00:07:54,880
What each tool does best feature comparison.
229
00:07:54,880 --> 00:07:56,800
So let's put them side by side on the tasks
230
00:07:56,800 --> 00:07:58,120
I teams do every day.
231
00:07:58,120 --> 00:08:00,200
This is where the differences really show up.
232
00:08:00,200 --> 00:08:01,880
Start with application deployment.
233
00:08:01,880 --> 00:08:03,600
In SCCM, you have full control.
234
00:08:03,600 --> 00:08:06,120
You can create complex deployments with dependencies.
235
00:08:06,120 --> 00:08:08,600
Install this, then that, then check for a registry key
236
00:08:08,600 --> 00:08:09,680
before proceeding.
237
00:08:09,680 --> 00:08:12,040
You can schedule deployments for specific times,
238
00:08:12,040 --> 00:08:15,120
target specific collections, and configure superceedings
239
00:08:15,120 --> 00:08:17,840
so old versions get replaced automatically.
240
00:08:17,840 --> 00:08:19,880
If you need to deploy a line of business application
241
00:08:19,880 --> 00:08:23,880
with custom scripts and multiple MSI files, SCCM handles it,
242
00:08:23,880 --> 00:08:25,640
Intune can deploy applications too.
243
00:08:25,640 --> 00:08:29,240
Win32 apps, Microsoft Store Apps, line of business apps.
244
00:08:29,240 --> 00:08:29,920
But it's simpler.
245
00:08:29,920 --> 00:08:32,080
You upload the installer, configure detection rules,
246
00:08:32,080 --> 00:08:33,400
and assign it to a group.
247
00:08:33,400 --> 00:08:35,200
It works well for most common scenarios.
248
00:08:35,200 --> 00:08:39,440
But if you need deep orchestration and sequencing, SCCM still wins.
249
00:08:39,440 --> 00:08:42,640
Now OS deployment, this is where SCCM really shines.
250
00:08:42,640 --> 00:08:45,160
Task sequences let you do bare metal deployments.
251
00:08:45,160 --> 00:08:47,520
A blank hard drive becomes a fully configured Windows machine
252
00:08:47,520 --> 00:08:49,960
with applications, settings, and security policies.
253
00:08:49,960 --> 00:08:53,280
You can do in place upgrades from Windows 10 to Windows 11
254
00:08:53,280 --> 00:08:55,280
and customize every step of the process.
255
00:08:55,280 --> 00:08:58,200
Intune takes a different approach with Windows autopilot.
256
00:08:58,200 --> 00:09:00,240
The device arrives, the user signs in,
257
00:09:00,240 --> 00:09:01,400
and the cloud does the rest.
258
00:09:01,400 --> 00:09:04,200
It's faster, simpler, and works great for modern hardware.
259
00:09:04,200 --> 00:09:06,360
But if you need to re-image existing machines,
260
00:09:06,360 --> 00:09:08,120
handle complex upgrade scenarios
261
00:09:08,120 --> 00:09:11,480
or deploy custom Windows images, SCCM's task sequences
262
00:09:11,480 --> 00:09:12,640
are still the gold standard.
263
00:09:12,640 --> 00:09:14,320
Compliance in reporting is another area
264
00:09:14,320 --> 00:09:15,800
where the tools diverge.
265
00:09:15,800 --> 00:09:18,280
SCCM has SQL Server Reporting Services,
266
00:09:18,280 --> 00:09:20,640
so you can build custom reports on almost anything,
267
00:09:20,640 --> 00:09:22,360
which machines have a specific software,
268
00:09:22,360 --> 00:09:24,040
which are missing a critical update,
269
00:09:24,040 --> 00:09:26,840
what hardware configurations exist across your fleet.
270
00:09:26,840 --> 00:09:28,400
The reporting is deep and customizable,
271
00:09:28,400 --> 00:09:29,600
but it takes work to set up.
272
00:09:29,600 --> 00:09:31,240
Intune has cloud-based dashboards
273
00:09:31,240 --> 00:09:33,000
that are much easier to use.
274
00:09:33,000 --> 00:09:35,160
You can see compliance status at a glance,
275
00:09:35,160 --> 00:09:38,040
drill into specific devices and export reports.
276
00:09:38,040 --> 00:09:40,040
It's less customizable than SCCM,
277
00:09:40,040 --> 00:09:42,120
but for most organizations, it's enough.
278
00:09:42,120 --> 00:09:44,400
Mobile Device Management is Intune's territory.
279
00:09:44,400 --> 00:09:46,880
SCCM doesn't manage phones or tablets, period.
280
00:09:46,880 --> 00:09:51,080
If you have iPhones, Android devices, or iPads in your organization,
281
00:09:51,080 --> 00:09:52,760
Intune is the tool you need.
282
00:09:52,760 --> 00:09:55,520
It handles enrollment, app deployment, compliance policies,
283
00:09:55,520 --> 00:09:57,520
and remote wipe for mobile devices.
284
00:09:57,520 --> 00:09:59,160
SCCM simply can't do that.
285
00:09:59,160 --> 00:10:00,880
And Server Management goes the other way.
286
00:10:00,880 --> 00:10:04,000
SCCM handles servers, patching, monitoring, inventory,
287
00:10:04,000 --> 00:10:05,080
software deployment.
288
00:10:05,080 --> 00:10:06,200
It's built for it.
289
00:10:06,200 --> 00:10:08,560
Intune has some server support through Azure Arc,
290
00:10:08,560 --> 00:10:09,600
but it's limited.
291
00:10:09,600 --> 00:10:11,600
If you're managing Windows Server infrastructure,
292
00:10:11,600 --> 00:10:13,280
SCCM is still the right tool.
293
00:10:13,280 --> 00:10:14,800
So you can see the pattern.
294
00:10:14,800 --> 00:10:16,560
SCCM gives you depth and control
295
00:10:16,560 --> 00:10:18,720
for complex Windows and server scenarios.
296
00:10:18,720 --> 00:10:21,120
Intune gives you simplicity and cross-platform support
297
00:10:21,120 --> 00:10:22,360
for modern endpoints.
298
00:10:22,360 --> 00:10:24,040
But what if you need both?
299
00:10:24,040 --> 00:10:26,320
Co-management, running both at once.
300
00:10:26,320 --> 00:10:27,560
That's where Co-management comes in.
301
00:10:27,560 --> 00:10:28,920
It's Microsoft's supported model,
302
00:10:28,920 --> 00:10:31,240
where a single device runs under both SCCM
303
00:10:31,240 --> 00:10:34,480
and Intune at the same time, not either or, but both.
304
00:10:34,480 --> 00:10:35,720
Let's break down how this works.
305
00:10:35,720 --> 00:10:38,520
You enable Co-management on your SCCM managed devices.
306
00:10:38,520 --> 00:10:40,480
They enroll in Intune and now both tools
307
00:10:40,480 --> 00:10:41,840
manage them simultaneously.
308
00:10:41,840 --> 00:10:43,800
But you decide which tool handles which task.
309
00:10:43,800 --> 00:10:45,720
Microsoft calls these workloads sliders,
310
00:10:45,720 --> 00:10:48,080
think of them like a control panel with switches.
311
00:10:48,080 --> 00:10:50,680
For each category of management, compliance policies,
312
00:10:50,680 --> 00:10:52,520
device configuration, Windows updates,
313
00:10:52,520 --> 00:10:54,720
endpoint protection, application deployment,
314
00:10:54,720 --> 00:10:57,640
you slide the switch to either SCCM or Intune.
315
00:10:57,640 --> 00:10:59,840
That tool becomes the authority for that workload
316
00:10:59,840 --> 00:11:01,120
and the other tool steps back.
317
00:11:01,120 --> 00:11:03,040
For example, you could keep application deployment
318
00:11:03,040 --> 00:11:05,440
in SCCM because your complex deployments
319
00:11:05,440 --> 00:11:08,080
still need the depth but slide compliance policies
320
00:11:08,080 --> 00:11:11,080
to Intune for cloud-native conditional access integration.
321
00:11:11,080 --> 00:11:12,920
You could keep Windows updates in SCCM
322
00:11:12,920 --> 00:11:14,720
with your existing maintenance windows
323
00:11:14,720 --> 00:11:16,680
but slide endpoint protection to Intune
324
00:11:16,680 --> 00:11:19,000
so Defender policies live in the cloud.
325
00:11:19,000 --> 00:11:21,400
You decide workload by workload at your own pace.
326
00:11:21,400 --> 00:11:23,400
There's also a feature called tenant attach
327
00:11:23,400 --> 00:11:26,160
which surfaces your SCCM managed devices
328
00:11:26,160 --> 00:11:27,800
inside the Intune console.
329
00:11:27,800 --> 00:11:29,640
So even if you're not ready to move workloads,
330
00:11:29,640 --> 00:11:31,680
you can see all your devices in one place,
331
00:11:31,680 --> 00:11:34,800
run reports, take actions, and get that unified view
332
00:11:34,800 --> 00:11:36,960
without changing how anything works.
333
00:11:36,960 --> 00:11:39,960
This makes co-management a gradual migration path.
334
00:11:39,960 --> 00:11:42,720
Most organizations use it for 12 to 18 months,
335
00:11:42,720 --> 00:11:44,880
starting with the easy workloads like compliance
336
00:11:44,880 --> 00:11:46,920
and endpoint protection, then moving updates,
337
00:11:46,920 --> 00:11:49,720
then applications step-by-step workload by workload
338
00:11:49,720 --> 00:11:51,520
until Intune handles most of the load
339
00:11:51,520 --> 00:11:53,760
and SCCM only does what it does best.
340
00:11:53,760 --> 00:11:56,360
And here's the thing that surprises a lot of people licensing.
341
00:11:56,360 --> 00:11:59,120
If you have Microsoft 365 e3 or e5,
342
00:11:59,120 --> 00:12:01,800
you usually already have rights to both SCCM and Intune
343
00:12:01,800 --> 00:12:03,440
so running both doesn't cost extra.
344
00:12:03,440 --> 00:12:05,080
The licensing is already covered.
345
00:12:05,080 --> 00:12:07,440
There's no financial reason not to use co-management
346
00:12:07,440 --> 00:12:09,160
if it makes sense for your environment.
347
00:12:09,160 --> 00:12:11,560
Co-management is the bridge letting you keep what works
348
00:12:11,560 --> 00:12:13,080
while moving towards what's next,
349
00:12:13,080 --> 00:12:16,680
but where you start depends entirely on your organization.
350
00:12:16,680 --> 00:12:19,320
Decision framework, which one should you use?
351
00:12:19,320 --> 00:12:22,120
So you've seen how both tools work, how they compare,
352
00:12:22,120 --> 00:12:24,240
and how co-management bridges the gap.
353
00:12:24,240 --> 00:12:27,000
The question now is simple, which one should you actually use?
354
00:12:27,000 --> 00:12:28,240
Let's break it down by scenario.
355
00:12:28,240 --> 00:12:31,840
Use SCCM if you have a large on-premises environment.
356
00:12:31,840 --> 00:12:34,080
If your organization has hundreds or thousands
357
00:12:34,080 --> 00:12:37,600
of Windows desktop's in offices connected to a corporate network
358
00:12:37,600 --> 00:12:40,280
with IT staff managing everything locally.
359
00:12:40,280 --> 00:12:42,880
If you need task sequences for OS deployment,
360
00:12:42,880 --> 00:12:45,080
imaging new machines, upgrading operating systems,
361
00:12:45,080 --> 00:12:46,560
handling complex build processes,
362
00:12:46,560 --> 00:12:49,200
or if you manage servers, patching, monitoring, inventory,
363
00:12:49,200 --> 00:12:50,680
if you require deep custom reporting
364
00:12:50,680 --> 00:12:52,800
that pulls data from SQL databases
365
00:12:52,800 --> 00:12:54,600
and generates detailed compliance audits,
366
00:12:54,600 --> 00:12:57,000
SCCM is built for these scenarios.
367
00:12:57,000 --> 00:13:00,120
It's mature, proven, and gives you the control you need.
368
00:13:00,120 --> 00:13:03,200
On the other hand, use Intune if you're cloud-first.
369
00:13:03,200 --> 00:13:06,320
If your organization has already moved most of its infrastructure
370
00:13:06,320 --> 00:13:08,520
to the cloud or you're planning to.
371
00:13:08,520 --> 00:13:10,520
If you have a remote workforce working from home,
372
00:13:10,520 --> 00:13:13,360
coffee shops anywhere, if you need to manage mobile devices
373
00:13:13,360 --> 00:13:15,920
like iPhones, Android phones, iPads,
374
00:13:15,920 --> 00:13:19,200
if you're a smaller organization without dedicated IT infrastructure
375
00:13:19,200 --> 00:13:21,080
or the budget for on-premises servers.
376
00:13:21,080 --> 00:13:23,800
Intune gives you everything you need without the overhead.
377
00:13:23,800 --> 00:13:26,240
And for large enterprises migrating to the cloud,
378
00:13:26,240 --> 00:13:27,760
co-management is the bridge.
379
00:13:27,760 --> 00:13:30,640
If you have existing SCCM infrastructure and expertise
380
00:13:30,640 --> 00:13:33,480
but know the future is cloud-based, use co-management.
381
00:13:33,480 --> 00:13:36,000
If you need the depth of SCCM for some workloads
382
00:13:36,000 --> 00:13:38,840
like complex app deployments or server management,
383
00:13:38,840 --> 00:13:41,200
but want cloud flexibility for compliance policies
384
00:13:41,200 --> 00:13:44,440
or mobile device management, co-management lets you have both.
385
00:13:44,440 --> 00:13:46,440
Shifting workloads at your own pace.
386
00:13:46,440 --> 00:13:47,760
Here's a reality check.
387
00:13:47,760 --> 00:13:50,000
Intune can handle roughly 80 to 85%
388
00:13:50,000 --> 00:13:51,720
of typical device management scenarios.
389
00:13:51,720 --> 00:13:52,560
That's a lot.
390
00:13:52,560 --> 00:13:54,560
And for most organizations, Intune alone is enough,
391
00:13:54,560 --> 00:13:57,120
but that 15 to 20% gap matters if you need it.
392
00:13:57,120 --> 00:13:59,680
If you're in that gap, needing task sequences,
393
00:13:59,680 --> 00:14:02,360
complex app dependencies, deep server management,
394
00:14:02,360 --> 00:14:05,160
then SCCM or co-management is the right call.
395
00:14:05,160 --> 00:14:07,480
A real example helps bring this to life.
396
00:14:07,480 --> 00:14:08,760
Real-world example.
397
00:14:08,760 --> 00:14:10,160
A company's migration.
398
00:14:10,160 --> 00:14:13,320
Picture a mid-sized company with 2,000 Windows desktops
399
00:14:13,320 --> 00:14:14,920
and 500 mobile devices.
400
00:14:14,920 --> 00:14:16,840
They started with SCCM for everything
401
00:14:16,840 --> 00:14:18,360
and for years it worked well.
402
00:14:18,360 --> 00:14:20,440
The IT team knew that tool inside and out,
403
00:14:20,440 --> 00:14:22,800
deployments were controlled, patching was predictable,
404
00:14:22,800 --> 00:14:23,760
and life was good.
405
00:14:23,760 --> 00:14:25,360
But then remote work happened.
406
00:14:25,360 --> 00:14:27,080
Suddenly half the workforce was at home
407
00:14:27,080 --> 00:14:29,520
and those on-premises patching cycles stopped working.
408
00:14:29,520 --> 00:14:30,920
Devices that never left the office
409
00:14:30,920 --> 00:14:32,720
were now scattered across the city.
410
00:14:32,720 --> 00:14:34,640
VPN connections were slow,
411
00:14:34,640 --> 00:14:36,160
and maintenance windows didn't apply
412
00:14:36,160 --> 00:14:37,960
when machines were turned off at night.
413
00:14:37,960 --> 00:14:39,400
The old model was breaking.
414
00:14:39,400 --> 00:14:41,240
They didn't rip out SCCM overnight.
415
00:14:41,240 --> 00:14:44,160
Instead, they spent 14 months implementing co-management.
416
00:14:44,160 --> 00:14:47,160
First, they moved mobile device management to Intune,
417
00:14:47,160 --> 00:14:49,320
all 500 iPhones and Android devices
418
00:14:49,320 --> 00:14:50,720
now managed from the cloud.
419
00:14:50,720 --> 00:14:52,480
Next came compliance policies.
420
00:14:52,480 --> 00:14:54,200
Devices had to meet security standards
421
00:14:54,200 --> 00:14:57,520
before accessing company data enforced through conditional access.
422
00:14:57,520 --> 00:14:59,280
Then they moved Windows updates.
423
00:14:59,280 --> 00:15:01,080
Update rings replaced maintenance windows
424
00:15:01,080 --> 00:15:03,760
and devices checked directly with Microsoft servers
425
00:15:03,760 --> 00:15:06,680
instead of the on-premises WSUs infrastructure.
426
00:15:06,680 --> 00:15:09,440
But they kept task sequences in SCCM for situations
427
00:15:09,440 --> 00:15:11,240
like deploying a custom operating system
428
00:15:11,240 --> 00:15:12,960
image to a lab full of machines.
429
00:15:12,960 --> 00:15:15,200
They also kept complex app deployments there.
430
00:15:15,200 --> 00:15:16,600
The line of business applications
431
00:15:16,600 --> 00:15:18,920
with custom scripts and multiple dependencies,
432
00:15:18,920 --> 00:15:20,720
those stayed where the depth was.
433
00:15:20,720 --> 00:15:21,680
By the time they finished,
434
00:15:21,680 --> 00:15:24,520
server infrastructure costs were down by 60%.
435
00:15:24,520 --> 00:15:26,200
They decommissioned distribution points,
436
00:15:26,200 --> 00:15:28,120
management points and SQL servers.
437
00:15:28,120 --> 00:15:30,520
The remote worker experience improved dramatically.
438
00:15:30,520 --> 00:15:33,400
Devices got updates and policies without needing a VPN
439
00:15:33,400 --> 00:15:34,720
and they still had deep control
440
00:15:34,720 --> 00:15:36,960
for the legacy applications that required it.
441
00:15:36,960 --> 00:15:38,960
That's the pattern more organizations are following.
442
00:15:38,960 --> 00:15:40,240
Not a sudden switch,
443
00:15:40,240 --> 00:15:42,640
but a gradual workload by workload migration.
444
00:15:42,640 --> 00:15:43,920
Co-management is the bridge
445
00:15:43,920 --> 00:15:46,040
and the destination is a modern cloud-connected
446
00:15:46,040 --> 00:15:47,920
endpoint management strategy.
447
00:15:47,920 --> 00:15:49,360
So here's what you need to remember.
448
00:15:49,360 --> 00:15:52,680
SCCM and Intune solve the same problem in very different ways
449
00:15:52,680 --> 00:15:55,360
on premises depth versus cloud simplicity.
450
00:15:55,360 --> 00:15:58,000
Agent-based control versus profile-based flexibility.
451
00:15:58,000 --> 00:15:59,600
One is a 20-year veteran.
452
00:15:59,600 --> 00:16:01,680
The other is the future Microsoft is building.
453
00:16:01,680 --> 00:16:03,560
Intune is the direction things are heading,
454
00:16:03,560 --> 00:16:05,240
but SCCM is in dead.
455
00:16:05,240 --> 00:16:08,000
It's still the right tool for complex Windows environments,
456
00:16:08,000 --> 00:16:09,760
server management and organizations
457
00:16:09,760 --> 00:16:11,160
that need deep control.
458
00:16:11,160 --> 00:16:12,920
And Co-management gives you both,
459
00:16:12,920 --> 00:16:16,200
a gradual path from one to the other at your own pace.
460
00:16:16,200 --> 00:16:17,280
Here's your homework.
461
00:16:17,280 --> 00:16:18,560
Look at your current environment
462
00:16:18,560 --> 00:16:21,760
and identify one workload you could move to Intune this month.
463
00:16:21,760 --> 00:16:23,160
Start with something simple.
464
00:16:23,160 --> 00:16:25,680
Compliance policies may be a mobile device management.
465
00:16:25,680 --> 00:16:26,520
Try it.
466
00:16:26,520 --> 00:16:27,360
See how it feels.
467
00:16:27,360 --> 00:16:28,800
You don't have to move everything at once.
468
00:16:28,800 --> 00:16:30,800
If this episode helped you understand the difference
469
00:16:30,800 --> 00:16:33,520
between SCCM and Intune, please subscribe to the channel.
470
00:16:33,520 --> 00:16:35,720
We break down Microsoft's endpoint management options
471
00:16:35,720 --> 00:16:38,280
in plain English, one knowledge nugget at a time.
00:00:00,000 --> 00:00:02,560
Today's topic is one that almost everyone has heard of,
2
00:00:02,560 --> 00:00:03,880
but most people get wrong.
3
00:00:03,880 --> 00:00:05,800
I'm talking about SCCM and Intune.
4
00:00:05,800 --> 00:00:07,440
You've probably heard both names thrown around,
5
00:00:07,440 --> 00:00:08,960
and it's easy to assume they're basically
6
00:00:08,960 --> 00:00:10,640
the same tool with different names,
7
00:00:10,640 --> 00:00:13,320
two Microsoft products that both manage devices, right?
8
00:00:13,320 --> 00:00:14,720
Well, not exactly, actually,
9
00:00:14,720 --> 00:00:16,320
they're two very different tools
10
00:00:16,320 --> 00:00:18,160
with different strengths, different philosophies
11
00:00:18,160 --> 00:00:20,200
and different infrastructure requirements.
12
00:00:20,200 --> 00:00:22,200
And picking the wrong one means you could waste time
13
00:00:22,200 --> 00:00:24,440
and money on infrastructure you don't need
14
00:00:24,440 --> 00:00:26,480
or miss the control you actually want.
15
00:00:26,480 --> 00:00:27,480
By the end of this episode,
16
00:00:27,480 --> 00:00:29,680
you'll understand what each tool actually does,
17
00:00:29,680 --> 00:00:31,400
how they compare side by side
18
00:00:31,400 --> 00:00:33,640
and which one makes sense for your organization.
19
00:00:33,640 --> 00:00:35,880
So grab your coffee and let's dive in.
20
00:00:35,880 --> 00:00:38,600
The core problem, managing devices at scale.
21
00:00:38,600 --> 00:00:41,560
Let's start with the problem, both tools are trying to solve.
22
00:00:41,560 --> 00:00:43,240
If you only have five computers in your office,
23
00:00:43,240 --> 00:00:44,200
you don't need either one.
24
00:00:44,200 --> 00:00:46,560
You can walk over and install software, run updates
25
00:00:46,560 --> 00:00:48,720
and fix things yourself and that works fine.
26
00:00:48,720 --> 00:00:51,880
But what happens with 500 computers or 5,000 or 50,000?
27
00:00:51,880 --> 00:00:53,760
The manual approach stops working very quickly.
28
00:00:53,760 --> 00:00:55,800
You can't have IT staff walking to every desk
29
00:00:55,800 --> 00:00:57,280
to install a security patch
30
00:00:57,280 --> 00:00:59,040
and you can't check each machine one by one
31
00:00:59,040 --> 00:01:00,120
for the right antivirus.
32
00:01:00,120 --> 00:01:01,400
It just doesn't scale.
33
00:01:01,400 --> 00:01:04,640
20 years ago, this was a huge problem for large organizations.
34
00:01:04,640 --> 00:01:06,720
IT teams had to physically visit machines,
35
00:01:06,720 --> 00:01:10,080
install software from CDs and run updates one at a time.
36
00:01:10,080 --> 00:01:12,160
That was slow, expensive and error prone.
37
00:01:12,160 --> 00:01:14,920
Microsoft looked at this problem and built two solutions,
38
00:01:14,920 --> 00:01:16,720
one for the old world where everything lived
39
00:01:16,720 --> 00:01:18,960
in your own building on your own servers
40
00:01:18,960 --> 00:01:22,240
and one for the new world, where devices are everywhere,
41
00:01:22,240 --> 00:01:25,400
users work remotely and the cloud handles the heavy lifting
42
00:01:25,400 --> 00:01:27,760
the first is SCCM and the second is in tune.
43
00:01:27,760 --> 00:01:30,480
They solve the same core problem, but in completely different ways.
44
00:01:30,480 --> 00:01:32,160
So before we compare them head to head,
45
00:01:32,160 --> 00:01:35,240
we need to understand what each one actually is.
46
00:01:35,240 --> 00:01:37,680
What is SCCM, the on-premises powerhouse?
47
00:01:37,680 --> 00:01:41,000
SCCM stands for System Center Configuration Manager.
48
00:01:41,000 --> 00:01:42,200
Though you might also hear it called
49
00:01:42,200 --> 00:01:45,520
Microsoft Endpoint Configuration Manager or MECM for short.
50
00:01:45,520 --> 00:01:48,480
That's the new name, but most people still call it SCCM.
51
00:01:48,480 --> 00:01:49,920
Here's the simplest definition.
52
00:01:49,920 --> 00:01:53,240
SCCM is an on-premises tool that you run on your own servers
53
00:01:53,240 --> 00:01:55,280
inside your own building on your own network.
54
00:01:55,280 --> 00:01:57,720
It's software you install and maintain yourself
55
00:01:57,720 --> 00:01:59,560
and it's been the go-to for large enterprises
56
00:01:59,560 --> 00:02:00,880
for over two decades.
57
00:02:00,880 --> 00:02:03,960
SCCM works using what's called an agent-based model.
58
00:02:03,960 --> 00:02:05,640
A small piece of software gets installed
59
00:02:05,640 --> 00:02:07,520
on every device you want to manage
60
00:02:07,520 --> 00:02:11,400
and that agent reports back to the SCCM server receives commands
61
00:02:11,400 --> 00:02:12,640
and carries out tasks.
62
00:02:12,640 --> 00:02:15,760
It's like having a tiny IT assistant living on each computer,
63
00:02:15,760 --> 00:02:16,920
waiting for instructions.
64
00:02:16,920 --> 00:02:18,800
So what can SCCM actually do?
65
00:02:18,800 --> 00:02:19,800
A lot.
66
00:02:19,800 --> 00:02:21,720
First, operating system deployment.
67
00:02:21,720 --> 00:02:24,440
You can push out windows to hundreds of new machines at once,
68
00:02:24,440 --> 00:02:27,440
saving days of manual effort, then software distribution.
69
00:02:27,440 --> 00:02:29,440
Install applications like Office or Chrome
70
00:02:29,440 --> 00:02:32,600
across your entire organization from one central console.
71
00:02:32,600 --> 00:02:34,000
It also handles patch management
72
00:02:34,000 --> 00:02:35,920
so you can roll out security updates
73
00:02:35,920 --> 00:02:37,760
on a schedule during maintenance windows
74
00:02:37,760 --> 00:02:40,200
with full control over timing and targeting.
75
00:02:40,200 --> 00:02:41,840
Compliance reporting shows which machines
76
00:02:41,840 --> 00:02:44,000
meet your security standards and which don't.
77
00:02:44,000 --> 00:02:45,680
An inventory gives you a complete picture
78
00:02:45,680 --> 00:02:48,160
of hardware and software across your environment.
79
00:02:48,160 --> 00:02:49,960
Large enterprises have relied on this tool
80
00:02:49,960 --> 00:02:51,040
for more than 20 years.
81
00:02:51,040 --> 00:02:53,160
It's mature, powerful, and gives IT teams
82
00:02:53,160 --> 00:02:55,600
deep granular control over Windows devices.
83
00:02:55,600 --> 00:02:57,240
Need to deploy a complex application
84
00:02:57,240 --> 00:02:59,200
with dependencies and custom scripts?
85
00:02:59,200 --> 00:03:00,680
SCCM can handle it.
86
00:03:00,680 --> 00:03:02,320
Need to image a hundred new laptops
87
00:03:02,320 --> 00:03:04,240
with a custom operating system build?
88
00:03:04,240 --> 00:03:04,920
That too.
89
00:03:04,920 --> 00:03:05,760
But here's the thing.
90
00:03:05,760 --> 00:03:08,160
SCCM requires serious infrastructure.
91
00:03:08,160 --> 00:03:11,320
You need domain controllers, SQL servers, site servers,
92
00:03:11,320 --> 00:03:12,880
distribution points, management points,
93
00:03:12,880 --> 00:03:14,320
and people who know how to set it all up
94
00:03:14,320 --> 00:03:16,480
and keep it running is not something you just turn on
95
00:03:16,480 --> 00:03:17,560
and forget about.
96
00:03:17,560 --> 00:03:19,240
And that's where it sibling comes in.
97
00:03:19,240 --> 00:03:22,120
A tool from Microsoft that takes a completely different approach.
98
00:03:22,120 --> 00:03:25,040
One that doesn't need any of that infrastructure at all.
99
00:03:25,040 --> 00:03:25,880
What is Intune?
100
00:03:25,880 --> 00:03:27,600
The Cloud Native Modern Tool.
101
00:03:27,600 --> 00:03:29,680
Now let's talk about the other option, Intune.
102
00:03:29,680 --> 00:03:31,120
Here's the simplest definition.
103
00:03:31,120 --> 00:03:32,480
It's a cloud-based service.
104
00:03:32,480 --> 00:03:33,520
No service to buy.
105
00:03:33,520 --> 00:03:34,960
No infrastructure to maintain.
106
00:03:34,960 --> 00:03:36,600
No SQL databases to manage.
107
00:03:36,600 --> 00:03:39,120
Everything runs inside Microsoft's Azure Data Centers.
108
00:03:39,120 --> 00:03:41,840
You sign in through a web browser, configure your policies,
109
00:03:41,840 --> 00:03:42,640
and you're done.
110
00:03:42,640 --> 00:03:44,600
Instead of the agent-based model, Intune
111
00:03:44,600 --> 00:03:46,000
uses a profile-based model.
112
00:03:46,000 --> 00:03:47,880
Devices enroll directly with the service
113
00:03:47,880 --> 00:03:50,720
over the internet, receive policies and configurations,
114
00:03:50,720 --> 00:03:53,280
and check in periodically to report their status.
115
00:03:53,280 --> 00:03:54,920
No agent software to install.
116
00:03:54,920 --> 00:03:56,760
No management points to configure.
117
00:03:56,760 --> 00:03:58,840
The device talks directly to the cloud.
118
00:03:58,840 --> 00:04:00,280
That's a big difference in scope.
119
00:04:00,280 --> 00:04:02,360
SCCM is primarily a Windows tool.
120
00:04:02,360 --> 00:04:03,840
It can manage some other platforms,
121
00:04:03,840 --> 00:04:05,480
but it's hard and soul is Windows.
122
00:04:05,480 --> 00:04:08,120
Intune, on the other hand, supports Windows, Mac OS, iOS,
123
00:04:08,120 --> 00:04:08,960
and Android.
124
00:04:08,960 --> 00:04:10,920
So if you have a mixed environment with iPhones
125
00:04:10,920 --> 00:04:13,200
for executives, Android tablets for field workers,
126
00:04:13,200 --> 00:04:14,720
and MacBooks for the design team,
127
00:04:14,720 --> 00:04:17,400
Intune can manage all of them from the same console.
128
00:04:17,400 --> 00:04:18,960
So what can Intune actually do?
129
00:04:18,960 --> 00:04:20,760
It handles device enrollment, uses
130
00:04:20,760 --> 00:04:23,640
can join their own devices, or IT can pre-configure them.
131
00:04:23,640 --> 00:04:26,360
It handles application deployment to Windows, Mac, iOS,
132
00:04:26,360 --> 00:04:27,240
and Android.
133
00:04:27,240 --> 00:04:29,400
Conditional access policies require devices
134
00:04:29,400 --> 00:04:32,520
to be compliant before they can access company data.
135
00:04:32,520 --> 00:04:35,280
Compliance policies define what a healthy device looks like
136
00:04:35,280 --> 00:04:36,600
and generate reports.
137
00:04:36,600 --> 00:04:38,680
And Windows update rings, let patches roll out
138
00:04:38,680 --> 00:04:41,920
in a controlled way, without needing WS/US or on-premises
139
00:04:41,920 --> 00:04:42,800
infrastructure.
140
00:04:42,800 --> 00:04:45,800
This is the direction Microsoft is investing in for the future.
141
00:04:45,800 --> 00:04:48,000
Almost every new feature in endpoint management
142
00:04:48,000 --> 00:04:49,680
is being built for Intune first.
143
00:04:49,680 --> 00:04:52,080
The cloud native approach is where development resources are
144
00:04:52,080 --> 00:04:52,400
going.
145
00:04:52,400 --> 00:04:55,240
So we've got two tools that both manage devices, one runs
146
00:04:55,240 --> 00:04:57,360
on your servers with agents, the other runs in the cloud
147
00:04:57,360 --> 00:04:58,360
with profiles.
148
00:04:58,360 --> 00:05:00,160
They're fundamentally different under the hood,
149
00:05:00,160 --> 00:05:02,560
and we're going to dig into what that actually means.
150
00:05:02,560 --> 00:05:05,120
On-premises versus cloud, the big difference.
151
00:05:05,120 --> 00:05:07,440
Actually, the big difference between SCCM and Intune
152
00:05:07,440 --> 00:05:08,680
comes down to just one thing--
153
00:05:08,680 --> 00:05:09,480
infrastructure.
154
00:05:09,480 --> 00:05:10,800
SCCM needs a lot of it.
155
00:05:10,800 --> 00:05:13,040
You need domain controllers for authentication,
156
00:05:13,040 --> 00:05:15,800
SQL servers to host the site database, site servers
157
00:05:15,800 --> 00:05:18,320
to run the core management role, distribution points
158
00:05:18,320 --> 00:05:20,400
to host content that devices download,
159
00:05:20,400 --> 00:05:23,000
and management points for client communication.
160
00:05:23,000 --> 00:05:24,960
Each of these is a separate server--
161
00:05:24,960 --> 00:05:27,720
or multiple servers, or running Windows server,
162
00:05:27,720 --> 00:05:31,000
consuming licenses requiring patches, needing backups.
163
00:05:31,000 --> 00:05:33,840
Intune needs one thing, an internet connection.
164
00:05:33,840 --> 00:05:34,360
That's it.
165
00:05:34,360 --> 00:05:37,000
No servers, no SQL databases, no distribution points,
166
00:05:37,000 --> 00:05:38,120
no management points.
167
00:05:38,120 --> 00:05:40,720
The infrastructure is Microsoft's problem, not yours.
168
00:05:40,720 --> 00:05:43,640
This difference shows up in every part of how these tools work.
169
00:05:43,640 --> 00:05:45,200
Take deployment methods.
170
00:05:45,200 --> 00:05:47,440
In SCCM, deploying a new operating system
171
00:05:47,440 --> 00:05:49,800
to a computer typically involves PXC boot.
172
00:05:49,800 --> 00:05:51,320
The device boots from the network,
173
00:05:51,320 --> 00:05:52,800
connects to a distribution point,
174
00:05:52,800 --> 00:05:55,320
and runs a task sequence that partitions the drive,
175
00:05:55,320 --> 00:05:58,560
installs Windows, applies settings, and installs applications.
176
00:05:58,560 --> 00:06:00,280
It's powerful, but it requires the device
177
00:06:00,280 --> 00:06:02,040
to be on the corporate network connected
178
00:06:02,040 --> 00:06:03,200
to the right infrastructure.
179
00:06:03,200 --> 00:06:04,960
Intune takes a completely different approach
180
00:06:04,960 --> 00:06:06,440
with Windows autopilot.
181
00:06:06,440 --> 00:06:08,360
A new laptop arrives from the manufacturer,
182
00:06:08,360 --> 00:06:10,240
already registered in your tenant.
183
00:06:10,240 --> 00:06:12,600
The user turns it on, connects to Wi-Fi,
184
00:06:12,600 --> 00:06:14,840
and signs in with their work credentials.
185
00:06:14,840 --> 00:06:17,600
From there, Windows configures itself automatically,
186
00:06:17,600 --> 00:06:20,600
applications install from the cloud, and policies apply.
187
00:06:20,600 --> 00:06:22,960
The device is ready to use in minutes, no imaging,
188
00:06:22,960 --> 00:06:25,880
no PXC boot, and no IT staff needed.
189
00:06:25,880 --> 00:06:27,920
Update management follows the same pattern.
190
00:06:27,920 --> 00:06:32,360
SCCM integrates with WSUS, Windows Server Update Services,
191
00:06:32,360 --> 00:06:34,280
to download and approve patches.
192
00:06:34,280 --> 00:06:35,520
You configure maintenance Windows,
193
00:06:35,520 --> 00:06:37,520
create deployment packages, target collections,
194
00:06:37,520 --> 00:06:38,560
and monitor compliance.
195
00:06:38,560 --> 00:06:41,920
It gives you deep control, but there are a lot of moving parts.
196
00:06:41,920 --> 00:06:44,320
Intune uses Windows Update for business.
197
00:06:44,320 --> 00:06:46,600
You create update rings, groups of devices
198
00:06:46,600 --> 00:06:48,600
with the same update settings, and decide
199
00:06:48,600 --> 00:06:51,360
how fast updates roll out when deadlines happen,
200
00:06:51,360 --> 00:06:53,440
and what features to defer.
201
00:06:53,440 --> 00:06:55,920
Devices check directly with Microsoft's update servers,
202
00:06:55,920 --> 00:06:58,520
no WSUS, no distribution points, no maintenance
203
00:06:58,520 --> 00:07:00,800
windows to configure, and security integration
204
00:07:00,800 --> 00:07:02,320
follows the same split.
205
00:07:02,320 --> 00:07:04,640
Intune connects natively with Azure Active Directory
206
00:07:04,640 --> 00:07:06,000
and conditional access.
207
00:07:06,000 --> 00:07:07,720
The device reports its compliance status.
208
00:07:07,720 --> 00:07:09,800
If it's not compliant, missing an update,
209
00:07:09,800 --> 00:07:11,960
no encryption, outdated antivirus,
210
00:07:11,960 --> 00:07:14,520
conditional access can block it from accessing email teams
211
00:07:14,520 --> 00:07:15,680
or SharePoint.
212
00:07:15,680 --> 00:07:17,560
It happens automatically in real time,
213
00:07:17,560 --> 00:07:20,000
without any on-premises infrastructure.
214
00:07:20,000 --> 00:07:22,080
SCCM has its own compliance engine.
215
00:07:22,080 --> 00:07:25,400
It can evaluate policies, generate reports, and remediate issues,
216
00:07:25,400 --> 00:07:27,280
but it doesn't integrate as seamlessly
217
00:07:27,280 --> 00:07:29,520
with cloud identity and access controls.
218
00:07:29,520 --> 00:07:32,160
You can make it work, but it takes more effort and more pieces.
219
00:07:32,160 --> 00:07:33,680
These differences aren't abstract.
220
00:07:33,680 --> 00:07:36,280
They matter depending on what you're actually trying to do.
221
00:07:36,280 --> 00:07:38,320
If your workforce is in one building,
222
00:07:38,320 --> 00:07:41,160
on the corporate network, with standardized Windows Desktops,
223
00:07:41,160 --> 00:07:43,680
SCCM's depth might be exactly what you need.
224
00:07:43,680 --> 00:07:46,080
But if your workforce is spread across the country,
225
00:07:46,080 --> 00:07:48,120
working from home on a mix of devices,
226
00:07:48,120 --> 00:07:50,320
Intune's cloud native approach starts to look
227
00:07:50,320 --> 00:07:51,960
a lot more practical.
228
00:07:51,960 --> 00:07:54,880
What each tool does best feature comparison.
229
00:07:54,880 --> 00:07:56,800
So let's put them side by side on the tasks
230
00:07:56,800 --> 00:07:58,120
I teams do every day.
231
00:07:58,120 --> 00:08:00,200
This is where the differences really show up.
232
00:08:00,200 --> 00:08:01,880
Start with application deployment.
233
00:08:01,880 --> 00:08:03,600
In SCCM, you have full control.
234
00:08:03,600 --> 00:08:06,120
You can create complex deployments with dependencies.
235
00:08:06,120 --> 00:08:08,600
Install this, then that, then check for a registry key
236
00:08:08,600 --> 00:08:09,680
before proceeding.
237
00:08:09,680 --> 00:08:12,040
You can schedule deployments for specific times,
238
00:08:12,040 --> 00:08:15,120
target specific collections, and configure superceedings
239
00:08:15,120 --> 00:08:17,840
so old versions get replaced automatically.
240
00:08:17,840 --> 00:08:19,880
If you need to deploy a line of business application
241
00:08:19,880 --> 00:08:23,880
with custom scripts and multiple MSI files, SCCM handles it,
242
00:08:23,880 --> 00:08:25,640
Intune can deploy applications too.
243
00:08:25,640 --> 00:08:29,240
Win32 apps, Microsoft Store Apps, line of business apps.
244
00:08:29,240 --> 00:08:29,920
But it's simpler.
245
00:08:29,920 --> 00:08:32,080
You upload the installer, configure detection rules,
246
00:08:32,080 --> 00:08:33,400
and assign it to a group.
247
00:08:33,400 --> 00:08:35,200
It works well for most common scenarios.
248
00:08:35,200 --> 00:08:39,440
But if you need deep orchestration and sequencing, SCCM still wins.
249
00:08:39,440 --> 00:08:42,640
Now OS deployment, this is where SCCM really shines.
250
00:08:42,640 --> 00:08:45,160
Task sequences let you do bare metal deployments.
251
00:08:45,160 --> 00:08:47,520
A blank hard drive becomes a fully configured Windows machine
252
00:08:47,520 --> 00:08:49,960
with applications, settings, and security policies.
253
00:08:49,960 --> 00:08:53,280
You can do in place upgrades from Windows 10 to Windows 11
254
00:08:53,280 --> 00:08:55,280
and customize every step of the process.
255
00:08:55,280 --> 00:08:58,200
Intune takes a different approach with Windows autopilot.
256
00:08:58,200 --> 00:09:00,240
The device arrives, the user signs in,
257
00:09:00,240 --> 00:09:01,400
and the cloud does the rest.
258
00:09:01,400 --> 00:09:04,200
It's faster, simpler, and works great for modern hardware.
259
00:09:04,200 --> 00:09:06,360
But if you need to re-image existing machines,
260
00:09:06,360 --> 00:09:08,120
handle complex upgrade scenarios
261
00:09:08,120 --> 00:09:11,480
or deploy custom Windows images, SCCM's task sequences
262
00:09:11,480 --> 00:09:12,640
are still the gold standard.
263
00:09:12,640 --> 00:09:14,320
Compliance in reporting is another area
264
00:09:14,320 --> 00:09:15,800
where the tools diverge.
265
00:09:15,800 --> 00:09:18,280
SCCM has SQL Server Reporting Services,
266
00:09:18,280 --> 00:09:20,640
so you can build custom reports on almost anything,
267
00:09:20,640 --> 00:09:22,360
which machines have a specific software,
268
00:09:22,360 --> 00:09:24,040
which are missing a critical update,
269
00:09:24,040 --> 00:09:26,840
what hardware configurations exist across your fleet.
270
00:09:26,840 --> 00:09:28,400
The reporting is deep and customizable,
271
00:09:28,400 --> 00:09:29,600
but it takes work to set up.
272
00:09:29,600 --> 00:09:31,240
Intune has cloud-based dashboards
273
00:09:31,240 --> 00:09:33,000
that are much easier to use.
274
00:09:33,000 --> 00:09:35,160
You can see compliance status at a glance,
275
00:09:35,160 --> 00:09:38,040
drill into specific devices and export reports.
276
00:09:38,040 --> 00:09:40,040
It's less customizable than SCCM,
277
00:09:40,040 --> 00:09:42,120
but for most organizations, it's enough.
278
00:09:42,120 --> 00:09:44,400
Mobile Device Management is Intune's territory.
279
00:09:44,400 --> 00:09:46,880
SCCM doesn't manage phones or tablets, period.
280
00:09:46,880 --> 00:09:51,080
If you have iPhones, Android devices, or iPads in your organization,
281
00:09:51,080 --> 00:09:52,760
Intune is the tool you need.
282
00:09:52,760 --> 00:09:55,520
It handles enrollment, app deployment, compliance policies,
283
00:09:55,520 --> 00:09:57,520
and remote wipe for mobile devices.
284
00:09:57,520 --> 00:09:59,160
SCCM simply can't do that.
285
00:09:59,160 --> 00:10:00,880
And Server Management goes the other way.
286
00:10:00,880 --> 00:10:04,000
SCCM handles servers, patching, monitoring, inventory,
287
00:10:04,000 --> 00:10:05,080
software deployment.
288
00:10:05,080 --> 00:10:06,200
It's built for it.
289
00:10:06,200 --> 00:10:08,560
Intune has some server support through Azure Arc,
290
00:10:08,560 --> 00:10:09,600
but it's limited.
291
00:10:09,600 --> 00:10:11,600
If you're managing Windows Server infrastructure,
292
00:10:11,600 --> 00:10:13,280
SCCM is still the right tool.
293
00:10:13,280 --> 00:10:14,800
So you can see the pattern.
294
00:10:14,800 --> 00:10:16,560
SCCM gives you depth and control
295
00:10:16,560 --> 00:10:18,720
for complex Windows and server scenarios.
296
00:10:18,720 --> 00:10:21,120
Intune gives you simplicity and cross-platform support
297
00:10:21,120 --> 00:10:22,360
for modern endpoints.
298
00:10:22,360 --> 00:10:24,040
But what if you need both?
299
00:10:24,040 --> 00:10:26,320
Co-management, running both at once.
300
00:10:26,320 --> 00:10:27,560
That's where Co-management comes in.
301
00:10:27,560 --> 00:10:28,920
It's Microsoft's supported model,
302
00:10:28,920 --> 00:10:31,240
where a single device runs under both SCCM
303
00:10:31,240 --> 00:10:34,480
and Intune at the same time, not either or, but both.
304
00:10:34,480 --> 00:10:35,720
Let's break down how this works.
305
00:10:35,720 --> 00:10:38,520
You enable Co-management on your SCCM managed devices.
306
00:10:38,520 --> 00:10:40,480
They enroll in Intune and now both tools
307
00:10:40,480 --> 00:10:41,840
manage them simultaneously.
308
00:10:41,840 --> 00:10:43,800
But you decide which tool handles which task.
309
00:10:43,800 --> 00:10:45,720
Microsoft calls these workloads sliders,
310
00:10:45,720 --> 00:10:48,080
think of them like a control panel with switches.
311
00:10:48,080 --> 00:10:50,680
For each category of management, compliance policies,
312
00:10:50,680 --> 00:10:52,520
device configuration, Windows updates,
313
00:10:52,520 --> 00:10:54,720
endpoint protection, application deployment,
314
00:10:54,720 --> 00:10:57,640
you slide the switch to either SCCM or Intune.
315
00:10:57,640 --> 00:10:59,840
That tool becomes the authority for that workload
316
00:10:59,840 --> 00:11:01,120
and the other tool steps back.
317
00:11:01,120 --> 00:11:03,040
For example, you could keep application deployment
318
00:11:03,040 --> 00:11:05,440
in SCCM because your complex deployments
319
00:11:05,440 --> 00:11:08,080
still need the depth but slide compliance policies
320
00:11:08,080 --> 00:11:11,080
to Intune for cloud-native conditional access integration.
321
00:11:11,080 --> 00:11:12,920
You could keep Windows updates in SCCM
322
00:11:12,920 --> 00:11:14,720
with your existing maintenance windows
323
00:11:14,720 --> 00:11:16,680
but slide endpoint protection to Intune
324
00:11:16,680 --> 00:11:19,000
so Defender policies live in the cloud.
325
00:11:19,000 --> 00:11:21,400
You decide workload by workload at your own pace.
326
00:11:21,400 --> 00:11:23,400
There's also a feature called tenant attach
327
00:11:23,400 --> 00:11:26,160
which surfaces your SCCM managed devices
328
00:11:26,160 --> 00:11:27,800
inside the Intune console.
329
00:11:27,800 --> 00:11:29,640
So even if you're not ready to move workloads,
330
00:11:29,640 --> 00:11:31,680
you can see all your devices in one place,
331
00:11:31,680 --> 00:11:34,800
run reports, take actions, and get that unified view
332
00:11:34,800 --> 00:11:36,960
without changing how anything works.
333
00:11:36,960 --> 00:11:39,960
This makes co-management a gradual migration path.
334
00:11:39,960 --> 00:11:42,720
Most organizations use it for 12 to 18 months,
335
00:11:42,720 --> 00:11:44,880
starting with the easy workloads like compliance
336
00:11:44,880 --> 00:11:46,920
and endpoint protection, then moving updates,
337
00:11:46,920 --> 00:11:49,720
then applications step-by-step workload by workload
338
00:11:49,720 --> 00:11:51,520
until Intune handles most of the load
339
00:11:51,520 --> 00:11:53,760
and SCCM only does what it does best.
340
00:11:53,760 --> 00:11:56,360
And here's the thing that surprises a lot of people licensing.
341
00:11:56,360 --> 00:11:59,120
If you have Microsoft 365 e3 or e5,
342
00:11:59,120 --> 00:12:01,800
you usually already have rights to both SCCM and Intune
343
00:12:01,800 --> 00:12:03,440
so running both doesn't cost extra.
344
00:12:03,440 --> 00:12:05,080
The licensing is already covered.
345
00:12:05,080 --> 00:12:07,440
There's no financial reason not to use co-management
346
00:12:07,440 --> 00:12:09,160
if it makes sense for your environment.
347
00:12:09,160 --> 00:12:11,560
Co-management is the bridge letting you keep what works
348
00:12:11,560 --> 00:12:13,080
while moving towards what's next,
349
00:12:13,080 --> 00:12:16,680
but where you start depends entirely on your organization.
350
00:12:16,680 --> 00:12:19,320
Decision framework, which one should you use?
351
00:12:19,320 --> 00:12:22,120
So you've seen how both tools work, how they compare,
352
00:12:22,120 --> 00:12:24,240
and how co-management bridges the gap.
353
00:12:24,240 --> 00:12:27,000
The question now is simple, which one should you actually use?
354
00:12:27,000 --> 00:12:28,240
Let's break it down by scenario.
355
00:12:28,240 --> 00:12:31,840
Use SCCM if you have a large on-premises environment.
356
00:12:31,840 --> 00:12:34,080
If your organization has hundreds or thousands
357
00:12:34,080 --> 00:12:37,600
of Windows desktop's in offices connected to a corporate network
358
00:12:37,600 --> 00:12:40,280
with IT staff managing everything locally.
359
00:12:40,280 --> 00:12:42,880
If you need task sequences for OS deployment,
360
00:12:42,880 --> 00:12:45,080
imaging new machines, upgrading operating systems,
361
00:12:45,080 --> 00:12:46,560
handling complex build processes,
362
00:12:46,560 --> 00:12:49,200
or if you manage servers, patching, monitoring, inventory,
363
00:12:49,200 --> 00:12:50,680
if you require deep custom reporting
364
00:12:50,680 --> 00:12:52,800
that pulls data from SQL databases
365
00:12:52,800 --> 00:12:54,600
and generates detailed compliance audits,
366
00:12:54,600 --> 00:12:57,000
SCCM is built for these scenarios.
367
00:12:57,000 --> 00:13:00,120
It's mature, proven, and gives you the control you need.
368
00:13:00,120 --> 00:13:03,200
On the other hand, use Intune if you're cloud-first.
369
00:13:03,200 --> 00:13:06,320
If your organization has already moved most of its infrastructure
370
00:13:06,320 --> 00:13:08,520
to the cloud or you're planning to.
371
00:13:08,520 --> 00:13:10,520
If you have a remote workforce working from home,
372
00:13:10,520 --> 00:13:13,360
coffee shops anywhere, if you need to manage mobile devices
373
00:13:13,360 --> 00:13:15,920
like iPhones, Android phones, iPads,
374
00:13:15,920 --> 00:13:19,200
if you're a smaller organization without dedicated IT infrastructure
375
00:13:19,200 --> 00:13:21,080
or the budget for on-premises servers.
376
00:13:21,080 --> 00:13:23,800
Intune gives you everything you need without the overhead.
377
00:13:23,800 --> 00:13:26,240
And for large enterprises migrating to the cloud,
378
00:13:26,240 --> 00:13:27,760
co-management is the bridge.
379
00:13:27,760 --> 00:13:30,640
If you have existing SCCM infrastructure and expertise
380
00:13:30,640 --> 00:13:33,480
but know the future is cloud-based, use co-management.
381
00:13:33,480 --> 00:13:36,000
If you need the depth of SCCM for some workloads
382
00:13:36,000 --> 00:13:38,840
like complex app deployments or server management,
383
00:13:38,840 --> 00:13:41,200
but want cloud flexibility for compliance policies
384
00:13:41,200 --> 00:13:44,440
or mobile device management, co-management lets you have both.
385
00:13:44,440 --> 00:13:46,440
Shifting workloads at your own pace.
386
00:13:46,440 --> 00:13:47,760
Here's a reality check.
387
00:13:47,760 --> 00:13:50,000
Intune can handle roughly 80 to 85%
388
00:13:50,000 --> 00:13:51,720
of typical device management scenarios.
389
00:13:51,720 --> 00:13:52,560
That's a lot.
390
00:13:52,560 --> 00:13:54,560
And for most organizations, Intune alone is enough,
391
00:13:54,560 --> 00:13:57,120
but that 15 to 20% gap matters if you need it.
392
00:13:57,120 --> 00:13:59,680
If you're in that gap, needing task sequences,
393
00:13:59,680 --> 00:14:02,360
complex app dependencies, deep server management,
394
00:14:02,360 --> 00:14:05,160
then SCCM or co-management is the right call.
395
00:14:05,160 --> 00:14:07,480
A real example helps bring this to life.
396
00:14:07,480 --> 00:14:08,760
Real-world example.
397
00:14:08,760 --> 00:14:10,160
A company's migration.
398
00:14:10,160 --> 00:14:13,320
Picture a mid-sized company with 2,000 Windows desktops
399
00:14:13,320 --> 00:14:14,920
and 500 mobile devices.
400
00:14:14,920 --> 00:14:16,840
They started with SCCM for everything
401
00:14:16,840 --> 00:14:18,360
and for years it worked well.
402
00:14:18,360 --> 00:14:20,440
The IT team knew that tool inside and out,
403
00:14:20,440 --> 00:14:22,800
deployments were controlled, patching was predictable,
404
00:14:22,800 --> 00:14:23,760
and life was good.
405
00:14:23,760 --> 00:14:25,360
But then remote work happened.
406
00:14:25,360 --> 00:14:27,080
Suddenly half the workforce was at home
407
00:14:27,080 --> 00:14:29,520
and those on-premises patching cycles stopped working.
408
00:14:29,520 --> 00:14:30,920
Devices that never left the office
409
00:14:30,920 --> 00:14:32,720
were now scattered across the city.
410
00:14:32,720 --> 00:14:34,640
VPN connections were slow,
411
00:14:34,640 --> 00:14:36,160
and maintenance windows didn't apply
412
00:14:36,160 --> 00:14:37,960
when machines were turned off at night.
413
00:14:37,960 --> 00:14:39,400
The old model was breaking.
414
00:14:39,400 --> 00:14:41,240
They didn't rip out SCCM overnight.
415
00:14:41,240 --> 00:14:44,160
Instead, they spent 14 months implementing co-management.
416
00:14:44,160 --> 00:14:47,160
First, they moved mobile device management to Intune,
417
00:14:47,160 --> 00:14:49,320
all 500 iPhones and Android devices
418
00:14:49,320 --> 00:14:50,720
now managed from the cloud.
419
00:14:50,720 --> 00:14:52,480
Next came compliance policies.
420
00:14:52,480 --> 00:14:54,200
Devices had to meet security standards
421
00:14:54,200 --> 00:14:57,520
before accessing company data enforced through conditional access.
422
00:14:57,520 --> 00:14:59,280
Then they moved Windows updates.
423
00:14:59,280 --> 00:15:01,080
Update rings replaced maintenance windows
424
00:15:01,080 --> 00:15:03,760
and devices checked directly with Microsoft servers
425
00:15:03,760 --> 00:15:06,680
instead of the on-premises WSUs infrastructure.
426
00:15:06,680 --> 00:15:09,440
But they kept task sequences in SCCM for situations
427
00:15:09,440 --> 00:15:11,240
like deploying a custom operating system
428
00:15:11,240 --> 00:15:12,960
image to a lab full of machines.
429
00:15:12,960 --> 00:15:15,200
They also kept complex app deployments there.
430
00:15:15,200 --> 00:15:16,600
The line of business applications
431
00:15:16,600 --> 00:15:18,920
with custom scripts and multiple dependencies,
432
00:15:18,920 --> 00:15:20,720
those stayed where the depth was.
433
00:15:20,720 --> 00:15:21,680
By the time they finished,
434
00:15:21,680 --> 00:15:24,520
server infrastructure costs were down by 60%.
435
00:15:24,520 --> 00:15:26,200
They decommissioned distribution points,
436
00:15:26,200 --> 00:15:28,120
management points and SQL servers.
437
00:15:28,120 --> 00:15:30,520
The remote worker experience improved dramatically.
438
00:15:30,520 --> 00:15:33,400
Devices got updates and policies without needing a VPN
439
00:15:33,400 --> 00:15:34,720
and they still had deep control
440
00:15:34,720 --> 00:15:36,960
for the legacy applications that required it.
441
00:15:36,960 --> 00:15:38,960
That's the pattern more organizations are following.
442
00:15:38,960 --> 00:15:40,240
Not a sudden switch,
443
00:15:40,240 --> 00:15:42,640
but a gradual workload by workload migration.
444
00:15:42,640 --> 00:15:43,920
Co-management is the bridge
445
00:15:43,920 --> 00:15:46,040
and the destination is a modern cloud-connected
446
00:15:46,040 --> 00:15:47,920
endpoint management strategy.
447
00:15:47,920 --> 00:15:49,360
So here's what you need to remember.
448
00:15:49,360 --> 00:15:52,680
SCCM and Intune solve the same problem in very different ways
449
00:15:52,680 --> 00:15:55,360
on premises depth versus cloud simplicity.
450
00:15:55,360 --> 00:15:58,000
Agent-based control versus profile-based flexibility.
451
00:15:58,000 --> 00:15:59,600
One is a 20-year veteran.
452
00:15:59,600 --> 00:16:01,680
The other is the future Microsoft is building.
453
00:16:01,680 --> 00:16:03,560
Intune is the direction things are heading,
454
00:16:03,560 --> 00:16:05,240
but SCCM is in dead.
455
00:16:05,240 --> 00:16:08,000
It's still the right tool for complex Windows environments,
456
00:16:08,000 --> 00:16:09,760
server management and organizations
457
00:16:09,760 --> 00:16:11,160
that need deep control.
458
00:16:11,160 --> 00:16:12,920
And Co-management gives you both,
459
00:16:12,920 --> 00:16:16,200
a gradual path from one to the other at your own pace.
460
00:16:16,200 --> 00:16:17,280
Here's your homework.
461
00:16:17,280 --> 00:16:18,560
Look at your current environment
462
00:16:18,560 --> 00:16:21,760
and identify one workload you could move to Intune this month.
463
00:16:21,760 --> 00:16:23,160
Start with something simple.
464
00:16:23,160 --> 00:16:25,680
Compliance policies may be a mobile device management.
465
00:16:25,680 --> 00:16:26,520
Try it.
466
00:16:26,520 --> 00:16:27,360
See how it feels.
467
00:16:27,360 --> 00:16:28,800
You don't have to move everything at once.
468
00:16:28,800 --> 00:16:30,800
If this episode helped you understand the difference
469
00:16:30,800 --> 00:16:33,520
between SCCM and Intune, please subscribe to the channel.
470
00:16:33,520 --> 00:16:35,720
We break down Microsoft's endpoint management options
471
00:16:35,720 --> 00:16:38,280
in plain English, one knowledge nugget at a time.
Founder of m365.fm, m365.show and m365con.net
Mirko Peters is a Microsoft 365 expert, content creator, and founder of m365.fm, a platform dedicated to sharing practical insights on modern workplace technologies. His work focuses on Microsoft 365 governance, security, collaboration, and real-world implementation strategies.
Through his podcast and written content, Mirko provides hands-on guidance for IT professionals, architects, and business leaders navigating the complexities of Microsoft 365. He is known for translating complex topics into clear, actionable advice, often highlighting common mistakes and overlooked risks in real-world environments.
With a strong emphasis on community contribution and knowledge sharing, Mirko is actively building a platform that connects experts, shares experiences, and helps organizations get the most out of their Microsoft 365 investments.
