Co-management is a dual-management model where Intune and Configuration Manager control the same Windows endpoints at the same time. It lets organisations divide workloads between cloud and on-premises tooling so they can modernize gradually while preserving legacy application dependencies and endpoint controls that still require traditional Microsoft infrastructure.
How Co-Management Works
Co-management is not a single product feature so much as an operating model for Windows endpoint administration. Intune and Configuration Manager both remain active management planes, but each can own different workloads, such as compliance, configuration, updates, or application delivery. The value of the model is that organisations can modernise control by control instead of forcing a full endpoint platform replacement.
That split control matters because the same device may need cloud-first policy in one area and legacy on-premises control in another. In practice, co-management is used when endpoint operations have to keep pace with cloud adoption while preserving application compatibility, migration sequencing, and established management processes.
Why Organisations Use Co-Management
Co-management is usually adopted to reduce migration risk. It lets teams move selected workloads to Intune while leaving the rest in Configuration Manager until the organisation is ready, or until a workload is better suited to cloud management. That makes it useful in environments with long-lived Windows fleets, complex application dependencies, or change windows that cannot absorb a hard cutover.
The model also helps separate strategic change from operational continuity. Organisations can modernise policy delivery, remote management, and compliance workflows without immediately abandoning existing tooling, reporting, and deployment practices that still support business-critical endpoints.
Control Boundaries and Operational Trade-Offs
Co-management only works well when the boundary between the two management planes is deliberate and documented. If teams do not define which platform owns which workload, they can create duplicate policy paths, inconsistent compliance results, or confusion over which console is the source of truth for a device action.
The trade-off is flexibility versus coordination overhead. Co-management reduces migration pressure, but it also introduces governance complexity because endpoint administrators must understand where policy is set, how conflicts are resolved, and which operational team owns each workload during the transition.
Used well, the model can support gradual standardisation. Used poorly, it can leave an endpoint effectively split between two operating models that neither team fully owns.
Security Implications for Windows Endpoint Administration
Because co-management governs the same endpoints from two administrative planes, its security significance is less about the label and more about how access, policy, and configuration are partitioned. The main concern is control drift: if one platform enforces a setting differently from the other, the endpoint may end up with inconsistent posture, uncertain compliance evidence, or accidental exceptions that weaken hardening.
Security teams should treat the model as a transitional control state, not as a permanent default. The point is to retain protection while workloads shift, then progressively simplify the endpoint management estate as the organisation becomes comfortable with cloud-first operations. When the transition is left open-ended, the environment can accumulate technical debt, duplicated administration, and fragmented visibility across the device estate.
Risk and Threat Considerations
Co-management can create security exposure if the split between Intune and Configuration Manager is poorly governed, because policy gaps or overlapping control paths can weaken endpoint consistency. The risk is not the coexistence of two tools by itself, but the chance that one plane assumes a control is covered while the other does not enforce it in the same way.
Failure mechanism: Inconsistent workload ownership, conflicting settings, or incomplete migration sequencing can leave endpoints with weaker enforcement, stale posture data, or unmanaged exceptions that persist longer than intended.
Impact: Attackers or accidental misconfiguration can exploit those inconsistencies to gain persistence, bypass intended restrictions, or widen the difference between actual device state and the state administrators believe they have enforced.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | Co-management depends on defined endpoint baselines and controlled workload ownership. |
| CM-6 — Configuration Settings | Co-management is fundamentally about assigning configuration responsibilities across tools. | |
| AC-6 — Least Privilege | Dual-management increases the need to restrict who can change endpoint policy in either console. | |
| Recommendation — Define and maintain approved endpoint baselines for each management plane. Specify and enforce authoritative configuration settings for each co-managed workload. Limit administrative permissions to the minimum needed in each management platform. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Co-management is a configuration-governance model for endpoint assets. |
| CIS-5 — Account Management | Dual consoles require careful administrative account governance and separation of duties. | |
| Recommendation — Standardise secure endpoint configurations across both management tools. Review and restrict administrative accounts that can modify endpoint management policy. | ||
Practitioner Guidance
Governance implication: Treat each co-managed workload as having an explicit owner, a documented source of truth, and a defined exit plan from the dual-management state. That prevents the model from becoming permanent by accident and helps keep policy decisions aligned with migration progress.
What to watch for: Pay attention to duplicated settings, unresolved policy conflicts, and endpoints whose compliance or configuration reports differ depending on which management plane is queried. Those are often the earliest signs that the operating model needs tighter boundary control.
Practitioner takeaway: Co-management is most effective when it is used to stage a controlled transition, not to preserve ambiguity about who manages what.
Related resources from NHI Mgmt Group
- What is the difference between a co-existence migration and a full cutover from web access management to modern identity?
- What is the difference between co-management and full migration to Intune?
- What signs show that co-management is creating more complexity than value?
- What is NHI posture management?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org