'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Devices Incorrectly Showing as Co-Managed in Intune
Question details
Devices continue to display as co-managed in Microsoft Intune even after Configuration Manager has been removed.
- Product
- Microsoft Intune
- Device & OS
- Windows
- Scenario
- An IT administrator is cleaning up device management statuses in Intune after deprecating or removing Configuration Manager (SCCM).
- Observed behavior
- Devices incorrectly show a co-managed status in the portal due to stale enrollment data, leftover hybrid management settings, or cached device relationships.
Ensure you have Intune Administrator privileges in the Microsoft Endpoint Manager admin center and local administrative access to the affected Windows devices to review system logs.
Verify MDM Authority and Device Join Status
Ensure that your environment is correctly configured for Intune standalone management and that hybrid settings are fully disabled.
When migrating away from Configuration Manager, leftover hybrid configurations or incorrect MDM authority settings can cause devices to retain their co-managed status. Verifying these core cloud settings is the best first step.
Sign in to the Microsoft Endpoint Manager admin center, navigate to Tenant administration, and confirm the MDM authority is explicitly set to Microsoft Intune.
Check the Azure Active Directory (Entra ID) portal to ensure the devices are Azure AD joined rather than Hybrid Azure AD joined, as hybrid statuses may retain old co-management states.
Ensure that any previous Cloud Management Gateway (CMG) configurations have been properly removed or disabled so devices do not attempt to contact the legacy infrastructure.
Analyze CoManagementHandler Logs
Use local client logs to identify leftover Configuration Manager settings causing the device to report a co-managed state.
Check the Broker Plugin and Enrollment Permissions
Ensure the Azure AD Broker Plugin is functioning correctly and automatic enrollment permissions are properly configured.
Deploy WPS Office to Your Intune-Managed Devices
While managing endpoint configurations and troubleshooting Microsoft Intune environments, consider deploying WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office. It seamlessly integrates into enterprise environments and reduces overall software overhead.
Frequently Asked Questions
Why do devices still show as co-managed after removing SCCM?
Devices may retain a co-managed status due to stale enrollment data, cached device relationships on the local machine, or because the MDM authority hasn't fully updated to Intune Standalone in the cloud.
Where can I find the CoManagementHandler log file?
The CoManagementHandler log file is typically located in the %WinDir%\CCM\logs\ directory on the local Windows device.
Does Hybrid Azure AD join affect co-management status?
Yes. If a device remains Hybrid Azure AD joined after Configuration Manager is removed, it may still attempt to report hybrid management states. Transitioning devices to native Azure AD joined can help resolve stale co-management statuses.
What is the role of Microsoft.AAD.BrokerPlugin in Intune enrollment?
The Microsoft.AAD.BrokerPlugin package handles authentication and tokens for Azure AD. If it caches stale data or becomes corrupted, the device may fail to update its correct management authority with Intune.
