SCCM-to-Intune Migration: The Cloud Apocalypse Survival Checklist

🎯 Objective:

Migrate a massive hybrid infrastructure (15,000+ endpoints, some in Azure, some on-premises) from System Center Configuration Manager (SCCM) to Microsoft Intune. Mission: avoid catastrophe, retain control, secure everything, handle scale, and stay (mostly) sane.

Step 0: Mental Prep

☑ Accept that Intune ≠ SCCM

  • SCCM is centralized, on-prem, stateful, agent-based.

  • Intune is cloud-native, policy-based, stateless, powered by Azure AD, MDM and Graph API.

  • No PXE, no Task Sequences, no classic OSD in Intune.

☑ Team Readiness

  • Assign leads: Identity, Device Enrollment, App Packaging, Compliance, Support.

  • Get an Azure architect, an SCCM veteran, and someone who can read logs without blinking.

Step 1: Audit & Inventory

☑ Devices:

  • Use SCCM / CMPivot to collect hardware inventory.

  • Map device join types: AD-only, Hybrid AAD, AAD Join.

  • Segment by model, OS version, region, connectivity type.

☑ Applications:

  • Export all deployed apps from SCCM.

  • Classify by type: MSI, EXE, Script, Store, LOB.

  • Flag apps needing admin rights or lacking silent install.

  • Build a critical apps list.

☑ SCCM Workload Map:

  • What’s running: Updates? Task Sequences? CI/CD?

  • Identify Custom Baselines and dynamic/static collections.

☑ Identify Tech Debt:

  • Legacy VPNs? POS terminals? Print drivers from 2009?

  • Local shares, registry-tied apps, GPO-bound configs?

  • Anything non-silent is a red flag.

Step 2: Azure Infrastructure Readiness

☑ Azure AD:

  • AAD Connect healthy and syncing.

  • All devices Hybrid Joined or better.

  • Validate with dsregcmd /status.

☑ Dynamic Groups:

  • Create AAD dynamic device groups:

    • By OS type, ownership, department, region.

    • Use filters like: (device.deviceOSType -eq \"Windows\") and (device.deviceOwnership -eq \"Company\")

☑ Conditional Access:

  • Enforce MFA, block risky countries.

  • Add exclusions for pilot groups to prevent self-lockouts.

☑ Endpoint Security:

  • Hook up Microsoft Defender for Endpoint.

  • Configure ASR, Defender AV, BitLocker, firewall.

Step 3: App Packaging & Testing

☑ Conversion:

  • Use IntuneWinAppUtil.exe to package all installables.

  • Store source folders, install scripts, dependencies.

☑ Detection Rules:

  • File: C:\\Program Files\\App\\app.exe

  • Registry: HKLM\\Software\\Vendor\\Product\\Installed = 1

☑ Return Codes:

  • Success: 0, Reboot: 3010, Retry: 1618

  • Remediation scripts for anything weird

☑ Testing:

  • Manual install on clean non-SCCM device

  • Log all outcomes: success / fail / stuck

  • Record detection, timing, reboots

Step 4: Co-Management Setup

☑ Cloud Attach via SCCM Console

  • Enable CMG (Cloud Management Gateway)

  • Move workloads step-by-step:

    1. Compliance Policies

    2. Device Configuration

    3. Updates

    4. Endpoint Security

    5. App Deployment

    6. Client Management

☑ Monitor Everything:

  • Watch workload transition

  • Review client logs

  • Use the Co-Management Dashboard to track

Step 5: Enrollment & Autopilot

☑ Device Hash Collection

  • Run Get-WindowsAutopilotInfo.ps1

  • Import CSV to Intune

☑ Enrollment Status Page (ESP)

  • Set to Full Blocking Mode

  • Link to required policies and apps

☑ OEM Provisioning

  • Arrange factory provisioning with Group Tags

  • Use pre-staged Autopilot profiles

Step 6: Pilot Launch

☑ Build Your Pilot Group

  • 50–200 diverse users

  • Include regional variance and edge cases

☑ Tracking Tools:

  • Endpoint Analytics: boot time, crash ratio, user sentiment

  • Compliance results: pass / fail / not evaluated

  • Application install logs & dashboards

☑ Support Flow:

  • Set up a fast-lane escalation team

  • Distribute FAQ, survival guide, Teams channel

  • Enable Remote Help / Quick Assist

Step 7: Mass Rollout & SCCM Shutdown

☑ Scale Up with Logic

  • Expand AAD groups for phased rollout

  • Assign baselines and apps by region or device type

☑ Uninstall SCCM Cleanly

  • Use: ccmsetup.exe /uninstall

  • Confirm all workloads moved

  • Validate in reporting & analytics

☑ Infra Decommissioning

  • Shut down DPs, MPs, SUPs

  • Backup and archive SQL and reports

  • Toast your old WSUS with a glass of whiskey

Step 8: Post-Migration & Quality Review

☑ Documentation

  • Record changes, pain points, success metrics

  • Archive all scripts, configs, architecture

☑ Lessons Learned

  • Build feedback loops

  • Automate discovered manual steps

  • Plan Phase 2: advanced analytics, role-based access, EPM

🚀 You Made It

You didn’t just migrate — you survived.
Your infra’s alive, your logs are humming, and your apps are still installing.
You’ve turned Microsoft Intune from a glorified phone manager into a global enterprise beast.

And now… go tell the others.
Or sleep. You’ve earned it.