Intune vs Group Policy for a Small Business: Which Should You Use?

For a small business that uses Microsoft 365 and has no on-premises servers, use Microsoft Intune with Microsoft Entra joined Windows 11 PCs; Group Policy only makes sense if you already have an Active Directory domain with domain-joined computers. Many offices end up in between, with a domain and some cloud management, and that works too as long as you don't configure the same setting in both places. This guide explains how each tool works, what you need, and how to move from one to the other.

Who this is for and what you will have

This is for the person who looks after PCs in an office of a few to a few hundred people and has to decide how to apply settings such as BitLocker, password rules, update behaviour and Edge policies. By the end you will have a decision, a list of what each path needs, a migration route using Group Policy analytics, and a way to avoid policy conflicts.

The core difference

Group Policy is configuration delivered from Active Directory Domain Services. Domain-joined computers pull policy from domain controllers, usually over the office network or VPN.

Intune is a cloud mobile device management (MDM) service. Devices enrol with it and receive policy over the internet, with no need to see a domain controller. Intune also deploys apps and reports on compliance.

Intune's settings catalog includes Administrative Templates, which Microsoft says are built in (no downloading) and correlate to the Group Policy path you see in the Local Group Policy Editor. So many familiar settings exist in both tools.

How devices join

Microsoft Entra ID gives a device an identity in one of three ways: registration, join, or hybrid join. Microsoft describes the modern device scenario as focused on two of them.

• Microsoft Entra registration suits personal devices (BYOD) and phones and tablets.
• Microsoft Entra join suits Windows 11 and Windows 10 devices owned by the organisation.
• Microsoft Entra hybrid join is described as an interim step on the road to Microsoft Entra join, for organisations that still have on-premises AD.

All three can coexist in one organisation. Device identities are also a prerequisite for device-based Conditional Access and for Intune management. Devices that are Entra joined also get single sign-on to the organisation's on-premises resources, according to Microsoft's device identity overview, which matters if you keep a file server.

For new PCs in a cloud-first office, Entra join plus Intune enrolment through Windows Autopilot gives a clean setup with no domain.

Licensing

An Intune license is required for any user or device that benefits directly or indirectly from the service. Microsoft's licensing page says Intune is organised into three plans: Plan 1 (the base service), Plan 2 (adds capabilities such as Remote Help and Advanced Analytics) and the Intune Suite. Most organisations get it through a Microsoft 365 bundle rather than buying plans directly, and the page lists bundles such as Microsoft 365 E3, E5 and E7 as examples.

Microsoft describes Microsoft 365 Business Premium as designed for small and medium-sized businesses of up to 300 users, and as a solution that lets you manage and secure Windows, Mac, iOS and Android devices. Check the Microsoft 365 plan comparison for the exact Intune entitlement on your plan before relying on it.

Group Policy has no license of its own, but needs Windows Server for domain controllers and the Windows editions that support domain join. Remember that running servers has its own cost in hardware or Azure compute, patching and backup.

You can confirm what you have in the Microsoft Intune admin center under Tenant administration then Tenant status, where the Tenant details tab shows total licensed users and total Intune licenses.

Decision guide

Choose Intune (Entra joined) when

• You have no domain controllers and don't want to run any.
• Staff work remotely or from several sites and laptops rarely sit on the office network.
• You already pay for Microsoft 365 licences that include Intune.
• You manage mobile devices or Macs as well as Windows.
• You are buying new PCs and can enrol them with Autopilot.

Keep Group Policy when

• You already run Active Directory with working GPOs and domain-joined PCs.
• You depend on on-premises apps or file servers that need domain authentication, and you haven't planned a move.
• You rely on settings that have no MDM equivalent. Group Policy analytics will tell you which these are.
• Your devices are always on a reliable office network.

Use both (hybrid) when

• You are in the middle of a migration and need to move groups of devices over time.
• You need Intune's app deployment and compliance reporting while some settings still come from AD.

Microsoft's own framing is that hybrid join is an interim step, so treat the both-tools state as temporary and write down the end state.

Check what moves: Group Policy analytics

Group Policy analytics is the practical way to answer "can Intune replace our GPOs?" Microsoft says it imports and analyses on-premises GPOs, shows the settings that cloud-based MDM providers support, flags deprecated or unavailable settings, and can migrate imported GPOs to a settings catalog policy.

Export a GPO

1. On a computer with the Group Policy Management console, open GPMC.msc.
2. Expand your domain and Group Policy Objects.
3. Right-click the GPO and choose Save report.
4. Save as an XML File.

Each exported file must be less than 4 MB and have proper Unicode encoding. If a single GPO is larger than 4 MB, the import fails; reduce the number of settings in that GPO.

Import and read the results

1. In the Microsoft Intune admin center, select Devices then Manage devices then Group Policy analytics.
2. Select Import, choose one or more XML files and select Next.
3. Choose a scope tag if you use them, then Next and Create.

Intune analyses the file automatically and lists, for each GPO, an MDM Support percentage, an Unknown Settings indicator, and whether the GPO is Targeted in AD. Select the percentage to see each setting with its value, scope (user or device), minimum Windows build, and CSP name. Per setting, MDM Support shows Yes when a matching setting exists in the settings catalog and No when none exists.

Under Reports then Device management then Group policy analytics, the migration readiness report classifies settings as Ready for migration, Not supported or Deprecated. After you add or remove imported GPOs, Microsoft says it can take about 20 minutes for the readiness data to update.

One known limitation from Microsoft: the tool only supports non-ADMX settings in English, so a GPO with settings in other languages will show an inaccurate MDM Support percentage.

Migrate supported settings

For settings with MDM support you can create a settings catalog policy from the imported GPO. To create a policy by hand instead, go to Devices then Manage devices then Configuration then Create then New policy, set Platform to Windows 10 and later and Profile type to Settings catalog, then use Add settings and expand Administrative Templates. Settings with (User) in the name apply to users when they sign in, and settings without it apply to devices.

Microsoft notes that the older Templates then Administrative Templates profile type has been deprecated and is read-only since the December 2412 release, so use the settings catalog for new policies.

Avoid conflicts when both apply

If a PC receives the same setting from a GPO and from Intune, you can get unpredictable results. Microsoft's guidance:

• The MDMWinsOverGP setting (in the ControlPolicyConflict area of the Policy CSP) makes the MDM policy win. When set to 1, any MDM policy in Policy CSP with an equivalent Group Policy causes the GP service to block that setting from being set by Group Policy. The default is 0.
• It applies only to policies in the Policy CSP. It doesn't cover other MDM settings with Group Policy equivalents defined in other CSPs, such as the Defender CSP.
• Microsoft's advice is not to configure the same settings in both GPO and MDM unless they are under MDMWinsOverGP control, because otherwise there is a race condition and no guarantee which wins.
• For Windows Update specifically, Microsoft recommends IgnoreWindowsUpdateGroupPolicies, which makes devices ignore Group Policy Windows Update settings and apply only MDM values.

To see what a device actually received, create the MDM diagnostic report: go to Settings then Accounts then Access work or school, select the work account, scroll to Advanced Diagnostic Report and select Create Report. The report includes a list of any Group Policy settings blocked because the MDM equivalent is configured.

A simple rule keeps you safe: for each setting, pick one owner. Maintain a spreadsheet of settings and which tool owns them.

A phased plan for a small office

1. Inventory. List PCs, Windows editions, and what each GPO does.
2. Analyse. Export GPOs and import them into Group Policy analytics. Note the settings marked ready, unsupported or deprecated.
3. Pilot. Enrol a few test devices and apply a settings catalog policy with the first group of settings. Confirm results on the device.
4. Move by category. Migrate one area at a time, such as BitLocker, Edge, update rings, then retire the matching GPO settings to avoid duplicates. See BitLocker silent encryption with Intune and Intune update rings for specific areas.
5. Change the join type for new devices. Enrol new PCs as Entra joined with Autopilot rather than domain joining them.
6. Decide on AD. When nothing depends on the domain, plan its retirement, including servers, file shares and printers.

Troubleshooting

A setting shows as applied by Intune but behaves differently

Look for the same setting in a GPO. Create the MDM diagnostic report and check for blocked Group Policy settings, then remove the duplicate from one tool.

The import fails in Group Policy analytics

Check the XML file is under 4 MB and has proper Unicode encoding. Split a large GPO into smaller ones and export again.

MDM Support percentage looks wrong

If the GPO contains settings in a language other than English, the percentage is inaccurate. Review the settings list manually.

An admin can't see an imported GPO

Imported GPOs are visible only to admins who share a scope tag selected at import. If no tag was chosen, the Default tag applies and only admins scoped to Default can see it.

A user gets no policy after moving to Entra join

Confirm the device is enrolled in Intune and licensed, that the profile is assigned to the right user or device group, and that it has checked in. Settings apply the next time the device checks for configuration updates.

Checklist

• Decide your end state: cloud-only, or domain plus cloud for a defined period.
• Confirm licences for every user and device that Intune will manage.
• Run Group Policy analytics before committing.
• Give each setting one owner and avoid duplicates.
• Pilot on a few devices and verify on the device itself.
• Plan new PCs as Entra joined with Autopilot.

References

• Use Intune to import and analyze group policies (Microsoft Learn)
• Use ADMX templates on Windows devices in Intune (Microsoft Learn)
• What is device identity in Microsoft Entra ID? (Microsoft Learn)
• Microsoft Intune licensing plans and options (Microsoft Learn)
• ControlPolicyConflict Policy CSP (Microsoft Learn)
• Why choose Microsoft 365 Business Premium? (Microsoft Learn)