The GPO import decision path, taught by simulation: scan with GPO Analytics / MMAT, classify settings, then use the interactive mapping explorer below — 31 curated GPO → Intune mappings across 8 functional areas, each with the exact portal path and the drift warnings.
Export GPO inventory from GPO Analytics (Intune portal) or run the MMAT tool on a device sample. Group the report by CSE / policy area.
Split the findings: supported natively (Settings Catalog), needs ADMX-backed template, belongs in a security baseline, or has NO MDM equivalent (scripts/remediations).
Pilot cutover, validation and graduation detail unlocks with LogLens Pro Suite.
Pilot cutover, validation and graduation detail unlocks with LogLens Pro Suite.
Pilot cutover, validation and graduation detail unlocks with LogLens Pro Suite.
Password/lockout, UAC, logon rights — the classic hardening GPOs.
Group Policy
Password Policy (length, complexity, history)
Intune
Settings CatalogSettings Catalog → Password
Where: Devices → Configuration → Create → New policy → Windows → Settings catalog
Watch out: Native CSP (DeviceLock). Never duplicate via ADMX — the CSP wins and the ADMX copy just adds drift.
Group Policy
Account Lockout Policy
Intune
Settings CatalogSettings Catalog → Account lockout (or Entra smart lockout)
Where: Settings catalog → Account Lockout
Watch out: Cloud-native smart lockout in Entra often replaces the classic GPO entirely — decide which layer owns it.
Group Policy
Interactive logon: Do not display last user name
Intune
Security baselineWindows security baseline
Where: Devices → Security baselines → Windows security baseline
Watch out: Ships in the Microsoft baseline with a recommended default; import the baseline instead of hand-mapping.
Group Policy
User Account Control (UAC) behaviour
Intune
Security baselineSecurity Baseline + Settings Catalog → User Account Control
Where: Baseline "User Account Control" group
Watch out: Baseline covers the standard prompts; custom elevation flows go via Settings catalog.
Group Policy
Screensaver lock with password
Intune
Settings CatalogSettings Catalog → Password / Power
Where: Settings catalog
Watch out: Also enforceable via the screen-saver ADMX row if you need exact GP parity.
6 premium areas locked
Windows Update, Edge, Microsoft 365, Defender/ASR/LAPS, device UX and scripts mappings — the areas every real migration trips on — unlock with LogLens Pro Suite. Same subscription unlocks the SCCM lab and all 15 conflict simulations.
Tip: browser-print this page to PDF — the mapping explorer doubles as your migration design document.