# Intune vs Group Policy for a Small Business: Which Should You Use? > Decide whether to manage Windows 11 PCs in a small office with Microsoft Intune, Group Policy on Active Directory, or both, and how to move settings across with Group Policy analytics. Source: https://www.epifive.com/blog/intune-vs-group-policy-small-business · Published 2026-10-26 · EpiFive ## Key takeaways - Choose Intune with Microsoft Entra join for a cloud-first small office, and keep Group Policy only if you already run on-premises Active Directory. - Microsoft describes Microsoft Entra hybrid join as an interim step on the road to Microsoft Entra join. - Don't configure the same setting in both Group Policy and Intune, because outside MDMWinsOverGP coverage there is no guarantee which one wins. - Group Policy analytics imports exported GPO XML files up to 4 MB and reports MDM support, so you can see what moves to Intune before you commit. - Intune needs a license for every user or device that benefits from it, and most organisations get it through a Microsoft 365 bundle. For a small business that uses Microsoft 365 and has no on-premises servers, use Microsoft Intune with Microsoft Entra joined Windows 11 PCs; Group Policy only makes sense if you already have an Active Directory domain with domain-joined computers. Many offices end up in between, with a domain and some cloud management, and that works too as long as you don't configure the same setting in both places. This guide explains how each tool works, what you need, and how to move from one to the other. ## Who this is for and what you will have This is for the person who looks after PCs in an office of a few to a few hundred people and has to decide how to apply settings such as BitLocker, password rules, update behaviour and Edge policies. By the end you will have a decision, a list of what each path needs, a migration route using Group Policy analytics, and a way to avoid policy conflicts. ## The core difference **Group Policy** is configuration delivered from Active Directory Domain Services. Domain-joined computers pull policy from domain controllers, usually over the office network or VPN. **Intune** is a cloud mobile device management (MDM) service. Devices enrol with it and receive policy over the internet, with no need to see a domain controller. Intune also deploys apps and reports on compliance. | Question | Group Policy | Intune | | --- | --- | --- | | Where the policy comes from | Domain controllers (on-premises AD) | Microsoft cloud service | | Device identity | Domain joined | Microsoft Entra joined (or hybrid joined) | | Needs line of sight to the office network | Yes, or VPN | No, internet access is enough | | Typical interface | Group Policy Management console, `gpedit` locally | Microsoft Intune admin center | | Scope | Windows | Windows and also macOS, iOS and Android | | Settings model | ADMX templates, registry and preferences | Settings catalog, templates, CSPs | | Extra services | Needs servers and AD maintenance | Needs licences and a Microsoft Entra tenant | Intune's settings catalog includes **Administrative Templates**, which Microsoft says are built in (no downloading) and correlate to the Group Policy path you see in the Local Group Policy Editor. So many familiar settings exist in both tools. ## How devices join Microsoft Entra ID gives a device an identity in one of three ways: registration, join, or hybrid join. Microsoft describes the modern device scenario as focused on two of them. - **Microsoft Entra registration** suits personal devices (BYOD) and phones and tablets. - **Microsoft Entra join** suits Windows 11 and Windows 10 devices owned by the organisation. - **Microsoft Entra hybrid join** is described as an interim step on the road to Microsoft Entra join, for organisations that still have on-premises AD. All three can coexist in one organisation. Device identities are also a prerequisite for device-based Conditional Access and for Intune management. Devices that are Entra joined also get single sign-on to the organisation's on-premises resources, according to Microsoft's device identity overview, which matters if you keep a file server. For new PCs in a cloud-first office, Entra join plus Intune enrolment through [Windows Autopilot](https://www.epifive.com/blog/intune-windows-autopilot-deployment-guide) gives a clean setup with no domain. ## Licensing An Intune license is required for any user or device that benefits directly or indirectly from the service. Microsoft's licensing page says Intune is organised into three plans: Plan 1 (the base service), Plan 2 (adds capabilities such as Remote Help and Advanced Analytics) and the Intune Suite. Most organisations get it through a Microsoft 365 bundle rather than buying plans directly, and the page lists bundles such as Microsoft 365 E3, E5 and E7 as examples. Microsoft describes Microsoft 365 Business Premium as designed for small and medium-sized businesses of up to 300 users, and as a solution that lets you manage and secure Windows, Mac, iOS and Android devices. Check the Microsoft 365 plan comparison for the exact Intune entitlement on your plan before relying on it. Group Policy has no license of its own, but needs Windows Server for domain controllers and the Windows editions that support domain join. Remember that running servers has its own cost in hardware or Azure compute, patching and backup. You can confirm what you have in the Microsoft Intune admin center under **Tenant administration** then **Tenant status**, where the **Tenant details** tab shows total licensed users and total Intune licenses. ## Decision guide ### Choose Intune (Entra joined) when - You have no domain controllers and don't want to run any. - Staff work remotely or from several sites and laptops rarely sit on the office network. - You already pay for Microsoft 365 licences that include Intune. - You manage mobile devices or Macs as well as Windows. - You are buying new PCs and can enrol them with Autopilot. ### Keep Group Policy when - You already run Active Directory with working GPOs and domain-joined PCs. - You depend on on-premises apps or file servers that need domain authentication, and you haven't planned a move. - You rely on settings that have no MDM equivalent. Group Policy analytics will tell you which these are. - Your devices are always on a reliable office network. ### Use both (hybrid) when - You are in the middle of a migration and need to move groups of devices over time. - You need Intune's app deployment and compliance reporting while some settings still come from AD. Microsoft's own framing is that hybrid join is an interim step, so treat the both-tools state as temporary and write down the end state. ## Check what moves: Group Policy analytics Group Policy analytics is the practical way to answer "can Intune replace our GPOs?" Microsoft says it imports and analyses on-premises GPOs, shows the settings that cloud-based MDM providers support, flags deprecated or unavailable settings, and can migrate imported GPOs to a settings catalog policy. ### Export a GPO 1. On a computer with the Group Policy Management console, open `GPMC.msc`. 2. Expand your domain and **Group Policy Objects**. 3. Right-click the GPO and choose **Save report**. 4. Save as an **XML File**. Each exported file must be less than 4 MB and have proper Unicode encoding. If a single GPO is larger than 4 MB, the import fails; reduce the number of settings in that GPO. ### Import and read the results 1. In the Microsoft Intune admin center, select **Devices** then **Manage devices** then **Group Policy analytics**. 2. Select **Import**, choose one or more XML files and select **Next**. 3. Choose a scope tag if you use them, then **Next** and **Create**. Intune analyses the file automatically and lists, for each GPO, an **MDM Support** percentage, an **Unknown Settings** indicator, and whether the GPO is **Targeted in AD**. Select the percentage to see each setting with its value, scope (user or device), minimum Windows build, and CSP name. Per setting, **MDM Support** shows **Yes** when a matching setting exists in the settings catalog and **No** when none exists. Under **Reports** then **Device management** then **Group policy analytics**, the migration readiness report classifies settings as **Ready for migration**, **Not supported** or **Deprecated**. After you add or remove imported GPOs, Microsoft says it can take about 20 minutes for the readiness data to update. One known limitation from Microsoft: the tool only supports non-ADMX settings in English, so a GPO with settings in other languages will show an inaccurate MDM Support percentage. ### Migrate supported settings For settings with MDM support you can create a settings catalog policy from the imported GPO. To create a policy by hand instead, go to **Devices** then **Manage devices** then **Configuration** then **Create** then **New policy**, set **Platform** to **Windows 10 and later** and **Profile type** to **Settings catalog**, then use **Add settings** and expand **Administrative Templates**. Settings with `(User)` in the name apply to users when they sign in, and settings without it apply to devices. Microsoft notes that the older **Templates** then **Administrative Templates** profile type has been deprecated and is read-only since the December 2412 release, so use the settings catalog for new policies. ## Avoid conflicts when both apply If a PC receives the same setting from a GPO and from Intune, you can get unpredictable results. Microsoft's guidance: - The **MDMWinsOverGP** setting (in the ControlPolicyConflict area of the Policy CSP) makes the MDM policy win. When set to 1, any MDM policy in Policy CSP with an equivalent Group Policy causes the GP service to block that setting from being set by Group Policy. The default is 0. - It applies only to policies in the Policy CSP. It doesn't cover other MDM settings with Group Policy equivalents defined in other CSPs, such as the Defender CSP. - Microsoft's advice is not to configure the same settings in both GPO and MDM unless they are under MDMWinsOverGP control, because otherwise there is a race condition and no guarantee which wins. - For Windows Update specifically, Microsoft recommends **IgnoreWindowsUpdateGroupPolicies**, which makes devices ignore Group Policy Windows Update settings and apply only MDM values. To see what a device actually received, create the MDM diagnostic report: go to **Settings** then **Accounts** then **Access work or school**, select the work account, scroll to **Advanced Diagnostic Report** and select **Create Report**. The report includes a list of any Group Policy settings blocked because the MDM equivalent is configured. A simple rule keeps you safe: for each setting, pick one owner. Maintain a spreadsheet of settings and which tool owns them. ## A phased plan for a small office 1. **Inventory.** List PCs, Windows editions, and what each GPO does. 2. **Analyse.** Export GPOs and import them into Group Policy analytics. Note the settings marked ready, unsupported or deprecated. 3. **Pilot.** Enrol a few test devices and apply a settings catalog policy with the first group of settings. Confirm results on the device. 4. **Move by category.** Migrate one area at a time, such as BitLocker, Edge, update rings, then retire the matching GPO settings to avoid duplicates. See [BitLocker silent encryption with Intune](https://www.epifive.com/blog/bitlocker-silent-encryption-intune) and [Intune update rings](https://www.epifive.com/blog/intune-update-rings-windows-hotpatch) for specific areas. 5. **Change the join type for new devices.** Enrol new PCs as Entra joined with Autopilot rather than domain joining them. 6. **Decide on AD.** When nothing depends on the domain, plan its retirement, including servers, file shares and printers. ## Troubleshooting ### A setting shows as applied by Intune but behaves differently Look for the same setting in a GPO. Create the MDM diagnostic report and check for blocked Group Policy settings, then remove the duplicate from one tool. ### The import fails in Group Policy analytics Check the XML file is under 4 MB and has proper Unicode encoding. Split a large GPO into smaller ones and export again. ### MDM Support percentage looks wrong If the GPO contains settings in a language other than English, the percentage is inaccurate. Review the settings list manually. ### An admin can't see an imported GPO Imported GPOs are visible only to admins who share a scope tag selected at import. If no tag was chosen, the Default tag applies and only admins scoped to Default can see it. ### A user gets no policy after moving to Entra join Confirm the device is enrolled in Intune and licensed, that the profile is assigned to the right user or device group, and that it has checked in. Settings apply the next time the device checks for configuration updates. ## Checklist - Decide your end state: cloud-only, or domain plus cloud for a defined period. - Confirm licences for every user and device that Intune will manage. - Run Group Policy analytics before committing. - Give each setting one owner and avoid duplicates. - Pilot on a few devices and verify on the device itself. - Plan new PCs as Entra joined with Autopilot. ## References - [Use Intune to import and analyze group policies (Microsoft Learn)](https://learn.microsoft.com/en-us/intune/device-configuration/import-group-policy-analytics) - [Use ADMX templates on Windows devices in Intune (Microsoft Learn)](https://learn.microsoft.com/en-us/intune/device-configuration/settings-catalog/configure-admx-templates-windows) - [What is device identity in Microsoft Entra ID? (Microsoft Learn)](https://learn.microsoft.com/en-us/entra/identity/devices/overview) - [Microsoft Intune licensing plans and options (Microsoft Learn)](https://learn.microsoft.com/en-us/intune/fundamentals/licensing) - [ControlPolicyConflict Policy CSP (Microsoft Learn)](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict) - [Why choose Microsoft 365 Business Premium? (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-security-benefits) ## Frequently asked questions ### Should a small business use Intune or Group Policy? If you have no on-premises Active Directory and use Microsoft 365, use Intune with Microsoft Entra joined devices. If you already run domain controllers and domain-joined PCs, Group Policy keeps working and you can add Intune gradually. Choose by where your devices and identities live, not by which tool is newer. ### Can Intune and Group Policy manage the same PC? Yes, but don't configure the same setting in both. Microsoft says that for settings in the Policy CSP you can set MDMWinsOverGP so the MDM value wins, but that it doesn't cover settings in other CSPs such as Defender, where there's a race condition and no guarantee which one wins. ### What is Group Policy analytics in Intune? It is a tool that imports exported GPO XML files and shows which settings have an MDM equivalent, which are not supported and which are deprecated. You can then migrate supported settings into a settings catalog policy. Each exported GPO file must be under 4 MB. ### Do I need Active Directory to use Intune? No. Microsoft describes Windows devices as inherently cloud native, and Microsoft Entra join is the modern path for organisation-owned Windows 11 devices. Hybrid join exists for organisations that still need on-premises AD and is described as an interim step toward Entra join.