What should I consider when moving from Hybrid Join to Entra Join with Autopilot?

Entra-only devices can access many user-authenticated file shares, but they do not have an on-premises computer account. That means anything relying on machine authentication can break, including shares or NAS devices ACLed only to computer accounts, applications running as the computer, machine-context scheduled tasks, some IIS restrictions, and traditional printer discovery or management. Logon scripts and built-in mapped-drive workflows also need replacement; consider SharePoint, OneDrive, Universal Print, or carefully managed scripts. Certificates still work, but SCEP or PKCS deployments require the appropriate Intune Certificate Connector and supporting infrastructure. Entra-joined devices also need LAPS enabled in Entra device settings separately from the hybrid setup.

For the Intune baseline, start with Defender Antivirus and Firewall, BitLocker, LAPS, security baselines, Windows Update rings or Windows Autopatch, compliance policies, Conditional Access, local administrator management, device restrictions, delivery optimization, Edge configuration, Start and taskbar settings, applications, scripts, and any certificate profiles. Register Autopilot devices with their hardware hashes, preferably through the OEM or reseller. Microsoft generally recommends new devices be deployed as cloud-native Entra joined rather than hybrid joined, while keeping on-premises AD for servers. Plan the transition around hardware refresh or a reset/reimage, since there is no simple in-place conversion from hybrid join to Entra join. For third-party patching, Intune update policies and Windows Autopatch cover Microsoft updates; products such as Patch My PC are commonly evaluated for third-party application updates, but whether they are necessary depends on your application inventory and management requirements.

Treat the move as a migration from GPOs to Intune rather than running both indefinitely. Use groups and filters in Intune instead of OUs, and avoid overlapping assignments while a device is still receiving GPOs. GPO settings can take precedence or conflict with MDM policies, so test each workload and retire the corresponding GPO once the Intune policy is working. Group Policy analytics can help identify settings that do not have a direct MDM equivalent.

Cloud Kerberos Trust is mainly relevant to Windows Hello for Business. With Hello sign-in, it lets users access on-premises Kerberos resources without deploying a certificate-based trust, so it is worth setting up if you plan to use passwordless sign-in. Make sure Entra Connect, supported Windows and domain controller updates, the Entra Kerberos object, sufficient writable domain controllers, and network access to the domain controllers are all in place. Password-based sign-in can often provide access through the user's synced identity, but Hello scenarios need the Kerberos configuration for reliable SSO.