We currently use hybrid join with on-premises Active Directory, Group Policy, file shares, and some settings already moving into Intune. Our long-term goal is to deploy new desktops as Microsoft Entra-joined devices through Windows Autopilot while keeping on-premises AD for servers and other infrastructure.
We believe Cloud Kerberos Trust will help users access existing file shares, especially with Windows Hello for Business. Are there other features or workflows that commonly stop working after moving to Entra join only? What should we plan for around mapped drives, certificates, printers, scheduled tasks, machine-based authentication, and existing GPOs?
Also, what Intune policies and configuration areas should we prioritize, and is Patch My PC a commonly used option for third-party application patching?
3 Answers
Most of your existing GPO settings should be recreated in Intune, but avoid applying both versions to the same devices during the transition. Intune doesn't use OUs, so use Entra groups, filters, and assignment profiles instead. Be especially careful with settings that overlap, since a remaining GPO can override or conflict with an Intune policy while a device is still hybrid joined.
For the initial Intune baseline, prioritize Defender Antivirus and Firewall, BitLocker, security baselines, Windows Update rings, compliance policies, Conditional Access, local administrator management, device restrictions, application deployment, delivery optimization, and Autopilot profiles. Use Group Policy analytics to identify settings that don't have a direct MDM equivalent.
For patching, start with Intune Windows Update policies and consider Windows Autopatch if it fits your licensing and operational model. Third-party application updates are a separate concern. Patch My PC is a popular choice, but it isn't the only option; compare its application catalog, packaging workflow, reporting, and licensing with the Enterprise App Catalog or other patch-management products.
For Autopilot, have the hardware hashes registered to the tenant, ideally by the manufacturer or reseller, and validate networking, licensing, enrollment restrictions, deployment profiles, required applications, and ESP behavior before broad rollout. Microsoft generally recommends Entra join for new cloud-managed devices rather than making hybrid join the long-term design. Since there is no supported in-place conversion from hybrid join to Entra join, plan to move devices during hardware replacement or a reset/reimage process.
Cloud Kerberos Trust is mainly relevant to Windows Hello for Business. With Hello sign-in, it allows the user to obtain the required Kerberos access for on-premises resources without deploying a certificate-based trust model. Make sure Entra Connect is syncing the accounts, the devices can reach a writable domain controller, the required Windows and domain controller updates are installed, and the Entra Kerberos server object is configured.
An Entra-joined device can still access many traditional resources, but it has no computer account in on-premises AD. That means machine-based authentication can be a problem. Common examples include shares or NAS devices secured only for computer accounts, applications running under the machine identity, IIS permissions based on computer accounts, scheduled tasks accessing remote resources, and some traditional printer discovery or management workflows. Universal Print or another modern printing approach may be needed.
Mapped drives and AD logon scripts also don't have a built-in cloud-native equivalent. Consider moving suitable data to SharePoint or OneDrive, or use carefully managed scripts where file shares must remain. Certificates can still work through Intune using SCEP or PKCS profiles, but a Certificate Connector and the existing certificate infrastructure may be required. Entra LAPS is supported, though it must be enabled in the Entra device settings first.
Keeping AD for servers is fine; the key distinction is that the client itself no longer has an AD computer account. Review every dependency on computer-context authentication before switching a department over.
That overlap is easy to miss. A device can appear to be managed by Intune while a GPO is still enforcing the old value, so migration groups and clear exclusions are important.