--- title: "Ditch the GPOs: Migrate to Microsoft Intune" description: "Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions." canonical: "https://adamtheautomator.com/ditch-gpos-migrate-microsoft-intune-2/" --- # Ditch the GPOs: Migrate to Microsoft Intune > Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. Source: https://adamtheautomator.com/ditch-gpos-migrate-microsoft-intune-2/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Ditch the GPOs: Migrate to Microsoft Intune](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) # Ditch the GPOs: Migrate to Microsoft Intune [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)13 April 20267 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Azure](/tag/azure/) Table of Contents * [Prerequisites](#prerequisites) * [Export Your GPOs as XML](#export-your-gpos-as-xml) * [Import and Analyze in the Intune Admin Center](#import-and-analyze-in-the-intune-admin-center) * [Migrate Supported Settings](#migrate-supported-settings) * [Handle the Settings That Do Not Migrate](#handle-the-settings-that-do-not-migrate) * [Drive Mappings](#drive-mappings) * [Printer Deployments](#printer-deployments) * [Registry Keys and Custom Settings](#registry-keys-and-custom-settings) * [Manage the Hybrid Transition](#manage-the-hybrid-transition) * [Validate Before You Deploy Wide](#validate-before-you-deploy-wide) * [Rationalize, Do Not Just Migrate](#rationalize-do-not-just-migrate) You have spent years perfecting your Group Policy Objects. Dozens of GPOs, carefully nested OUs, inheritance rules you documented once and never looked at again. And yet here you are, managing a workforce where half your devices never touch the corporate network. GPOs require line-of-sight to a domain controller. [Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) does not. That single difference changes everything about how you manage Windows endpoints. The good news is you do not have to start from scratch. Microsoft built [Group Policy Analytics](https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics) directly into the Intune admin center. It reads your existing GPO exports, tells you exactly which settings translate to cloud-native equivalents, and can migrate supported settings into [Settings Catalog](https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog) profiles with a few clicks. The bad news is that not everything migrates cleanly, and the tool does not tell you that upfront. This walkthrough takes you through the full migration lifecycle: exporting your GPOs, analyzing them with Group Policy Analytics, migrating what the tool supports, and handling everything it leaves behind. ## Prerequisites Before you start, confirm you have these in place: * **Intune Administrator role** (or a custom role with Security Baselines and Device Configurations/Create [permissions](https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics#prerequisites)) * **Group Policy Management Console (GPMC)** installed on your management workstation * **Windows 10 or 11 target devices**—Group Policy Analytics only analyzes policies for these operating systems * A test Azure AD group for piloting migrated profiles before broad deployment * * * **_Reality Check: Group Policy Analytics does not support Windows Server policies or earlier client OS versions. If your GPOs target Server 2019 or Windows 8.1, those settings are invisible to this tool._** * * * ## Export Your GPOs as XML The migration starts on your domain controller or any workstation running GPMC. You need XML exports—not the HTML reports that GPMC defaults to. Open `GPMC.msc`, expand your domain, and navigate to the **Group Policy Objects** container. Right-click the GPO you want to migrate and select **Save Report**. Here is the part that trips people up: in the “Save as type” dropdown, change the format from HTML to **XML File (\*.xml)**. HTML exports look nice but are completely useless for Intune analysis. ``` # Export a single GPO to XML via PowerShell Get-GPOReport -Name "Desktop Security Policy" -ReportType Xml -Path "C:\GPOExports\DesktopSecurity.xml" ``` ```powershell # Bulk export all GPOs in the domain Get-GPO -All | ForEach-Object { Get-GPOReport -Guid $_.Id -ReportType Xml -Path "C:\GPOExports\$($_.DisplayName).xml" } ``` Before uploading, check your file sizes. Intune enforces a [4 MB limit per GPO XML file](https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics#prerequisites). If a GPO exceeds that, you will need to split it or remove deprecated settings before exporting. The XML must also be Unicode-encoded—anything else fails silently on import. * * * **_Pro Tip: Run the bulk export first, then sort by file size. You will immediately see which GPOs need trimming before they hit the Intune import wall._** * * * ## Import and Analyze in the Intune Admin Center With your XML files ready, open the [Intune admin center](https://intune.microsoft.com/) and navigate to **Devices > Group Policy analytics**. Click **Import**, upload your XML, and optionally assign [Scope Tags](https://learn.microsoft.com/en-us/mem/intune/fundamentals/scope-tags) to control which administrators can see the imported GPO. If you skip scope tags, the Default tag applies automatically. After import, Intune displays each GPO with an **MDM Support** percentage. This number represents the ratio of settings that have a direct equivalent in the Settings Catalog. Click the MDM Support percentage to drill into individual settings. Each one lands in one of three buckets: | Status | What It Means | Your Move | | --- | --- | --- | | **Ready for migration** | Direct match in the Settings Catalog | Migrate using the built-in wizard | | **Not supported** | No matching MDM setting exists | Handle via PowerShell scripts or custom OMA-URI | | **Deprecated** | Targets legacy features like IE8 settings | Retire—do not migrate dead weight | You may also see an **Unknown** column for settings the analytics engine identified but could not categorize. These typically involve custom registry keys or third-party ADMX settings that fall outside the standard CSP mappings. ## Migrate Supported Settings For settings marked “Ready for migration,” Group Policy Analytics provides a one-click migration path. Select the GPO from your analysis results, click **Migrate**, and choose the settings you want to include. The tool creates a new Settings Catalog profile and pre-populates values directly from your GPO—enabled/disabled states, numeric values, string configurations, all of it. ``` # After migration, verify the new profile exists # Connect to Microsoft Graph Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All" # List Settings Catalog profiles Get-MgDeviceManagementConfigurationPolicy | Select-Object Name, CreatedDateTime ``` Review every pre-populated value before assigning the profile. The migration is [best-effort](https://learn.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics-migrate)—if a setting has an unexpected format or a missing child dependency, the value may not transfer correctly. * * * **_Warning: Complex settings like AppLocker rules and Windows Firewall configurations are often grayed out in the migration wizard. Microsoft recommends configuring these through the dedicated_** [**_Endpoint Security workload_**](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-policy) **_rather than the Settings Catalog._** * * * Two important details about the destination profile type. Microsoft now recommends the [Settings Catalog](https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog) for all new policy configurations. The legacy “Administrative Templates” profile type is being phased out—you cannot create new ones, and existing ones should be migrated to Settings Catalog profiles. The Group Policy Analytics migration tool targets the Settings Catalog by default, so you are already on the right path. ## Handle the Settings That Do Not Migrate Here is where the real work starts. Group Policy Analytics handles OS configuration policies well, but [Group Policy Preferences](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922\(v=ws.11\)) (GPP)—drive mappings, printer deployments, scheduled tasks, shortcuts—do not come along for the ride. ### Drive Mappings Your users still need their `H:\` drive and their department shares. Three approaches, ranked by how cloud-native they are: | Approach | Effort | Cloud-Native Level | Best For | | --- | --- | --- | --- | | ADMX ingestion | Medium | Partial | Quick wins with existing UNC paths | | PowerShell scripts | Low | Partial | Flexible, one-off deployments | | Azure Files | High | Full | Long-term cloud-first strategy | 1. **ADMX ingestion**: Download a custom `DriveMapping.admx` and its `.adml` language file, import them to Intune under **Devices > Configuration > Import ADMX**, and create a profile using Imported Administrative Templates. This gets drive maps into the Settings Catalog workflow. 2. **PowerShell scripts**: Deploy a logon script through Intune’s [script deployment](https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension) feature. Wrap your `New-PSDrive` commands in a script and deploy it as a Win32 app or platform script. You lose item-level targeting, but gain flexibility. 3. **Azure Files**: Replace your on-premises UNC paths with [Azure Files](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-introduction) shares mounted via SMB. This is the architectural endgame but requires infrastructure changes. Yes, that is three options ranked from “cloud-ish” to “actually cloud.” Pick whichever matches your tolerance for infrastructure changes this quarter. ### Printer Deployments Legacy Group Policy printer deployments do not translate to Intune policies through Group Policy Analytics. You know those printer GPOs you have been maintaining since 2014? Time to rethink them. Your options: | Approach | Print Server Required | Best For | | --- | --- | --- | | Universal Print | No | New printer deployments, cloud-first orgs | | Win32 app packaging | Yes (for driver extraction) | Legacy printers you cannot replace yet | * [**Universal Print**](https://learn.microsoft.com/en-us/universal-print/fundamentals/universal-print-whatis): Microsoft’s cloud-based replacement for on-premises print servers. Intune has a native policy type for Universal Print provisioning. If you are buying new printers anyway, this is the path forward. * **Win32 app packaging**: For existing network printers, package the printer driver and installation logic into an `.intunewin` file. Tools like `PackageMyPrinters.ps1` can automate extracting driver details from your print server and wrapping them for Intune deployment. ### Registry Keys and Custom Settings For settings that show up as “Unknown” or rely on direct registry manipulation: ``` # Deploy registry settings via Intune PowerShell script Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\YourApp" -Name "SettingName" -Value 1 -Type DWord ``` You can deploy this through [Proactive Remediations](https://learn.microsoft.com/en-us/mem/intune/fundamentals/remediations) (requires specific licensing), which detect configuration drift and correct it automatically. For one-off settings, a simple platform script works. For CSPs not yet in the Settings Catalog, [custom OMA-URI](https://learn.microsoft.com/en-us/mem/intune/configuration/custom-settings-windows-10) profiles let you target the MDM path directly. ## Manage the Hybrid Transition Unless you are cutting over to cloud-only in a single weekend—and you probably are not—your devices will receive policies from both GPO and Intune simultaneously. This creates conflicts. The fix is the [MDMWinsOverGP policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict). Set it to `1`, and Intune settings take precedence over conflicting GPOs for any setting covered by the [Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider). ``` # Verify MDMWinsOverGP is applied on a client device Get-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\current\device\ControlPolicyConflict" -Name "MDMWinsOverGP" ``` One critical caveat: `MDMWinsOverGP` only covers the Policy CSP. Not every CSP gets the override treatment. | CSP | MDMWinsOverGP Coverage | If Conflict Exists | | --- | --- | --- | | Policy CSP | Covered | Intune wins automatically | | Defender CSP | Not covered | Unlink the GPO manually | | Windows Update CSP | Not covered | Unlink the GPO manually | | BitLocker CSP | Not covered | Unlink the GPO manually | For settings in uncovered CSPs, you must explicitly unlink or disable the conflicting GPO on your domain controllers. There is no MDM override—you have to remove the source. ## Validate Before You Deploy Wide Do not push migrated profiles to your entire fleet on day one. Build a validation workflow: 1. **Assign to a pilot group**: Create an Azure AD security group with a handful of test devices. Assign your migrated Settings Catalog profiles exclusively to this group. 2. **Run MDM diagnostics on a test device**: Generate the `MDMDiagReport.html` on a client device to verify which policies—GPO versus MDM—are actually applying. ``` # Generate MDM diagnostic report on the client mdmdiagnosticstool.exe -out C:\MDMDiag # Open the generated MDMDiagReport.html to review applied policies ``` 1. **Compare against your GPO baseline**: Confirm that every “Ready for migration” setting is applying correctly via Intune and that no GPO is overriding it unexpectedly. 2. **Expand in rings**: Once the pilot validates clean, expand to the next ring. Keep the GPOs linked but set `MDMWinsOverGP` so Intune wins. Only unlink GPOs after you have confirmed Intune coverage across all targeted settings. ## Rationalize, Do Not Just Migrate One final piece of advice before you start uploading XML files. Do not treat this as a lift-and-shift exercise. Your GPO environment almost certainly contains settings targeting Internet Explorer 6, Windows XP policies somebody forgot to clean up, and conflicting configurations across overlapping OUs. Group Policy Analytics will flag these as “Deprecated,” but it will not tell you to delete them. That is your job. Use this migration as an opportunity to audit your policy baseline. Start with [Intune Security Baselines](https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines) as your foundation for security settings rather than migrating 15-year-old GPO security policies line by line. The baselines reflect current Microsoft security recommendations and save you from carrying forward technical debt that should have been retired years ago. The end state is not “my GPOs in the cloud.” It is a modern, maintainable policy set that works whether your devices are in the office, at home, or at a coffee shop with questionable Wi-Fi. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fditch-gpos-migrate-microsoft-intune-2%2F&text=Ditch%20the%20GPOs%3A%20Migrate%20to%20Microsoft%20Intune)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fditch-gpos-migrate-microsoft-intune-2%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fditch-gpos-migrate-microsoft-intune-2%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/06/featured_image-21.png) ### [Automate SOC 2 Compliance with PowerShell](/automate-soc-2-compliance-powershell/) A comprehensive walkthrough on using PowerShell and Azure Policy as Code to automate evidence collection and enforce SOC 2 compliance controls across enterprise cloud environments. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)