Changing MDM authority from hybrid to standalone Intune

One of the cool new features of Intune release 1705 is the ability to change the MDM authority without the need to contact Microsoft support and also without having to unenroll and reenroll devices. This is a pretty cool feature that people have been waiting for for some time.

So how is it achieved?

Well first up you also need to running ConfigMgr Current Branch 1610 and above. There are some key considerations to take into account and you can view these at the Microsoft TechNet documentation site here, most notably that the transition time for devices can take up to 8 hours.

To kick start the process we need to fire up the ConfigMgr console and navigate to Administration\Cloud Services\Microsoft Intune Subscriptions, right click the Microsoft Intune Subscriptions and choose Properties.

2017-06-05 21_46_01-Greenshot.jpg

Select the Device Enrollment Manager tab and remove any Device Enrollment Manager roles.

2017-06-05 21_48_52-Microsoft Intune Subscription Properties.jpg

In Assets and Compliance\Overview, right click Device Collections and choose Manage Device Categories.

2017-06-05 21_52_44-Greenshot.jpg

Remove any existing device categories.

2017-06-05 21_52_49-Manage Device Categories.jpg

Next, navigate back to Administration\Cloud Services\Microsoft Intune Subscriptions, right click the subscription and this time choose Delete.

2017-06-05 21_56_49-Greenshot.jpg

From the wizard, select the Change MDM Authority to Microsoft Intune option and click Next.

2017-06-05 21_58_21-Remove Microsoft Intune Subscription Wizard.jpg

Click Yes to confirm the change.

2017-06-05 21_58_33-Configuration Manager.jpg

Now you will need to sign into Intune with the account that was originally used to set ConfigMgr as the MDM authority by clicking the Sign In button.

2017-06-05 21_58_54-Remove Microsoft Intune Subscription Wizard.jpg

Enter the username and password when prompted and sign in.

2017-06-05 21_59_18-Subscription.jpg

Click Next.

2017-06-05 21_59_30-Remove Microsoft Intune Subscription Wizard.jpg

Click Next at the Summary screen.

2017-06-05 21_59_38-Remove Microsoft Intune Subscription Wizard.jpg

Click Close to complete the removal of the subscription.

2017-06-05 22_00_54-Remove Microsoft Intune Subscription Wizard.jpg

This process resets the MDM authority and no subscriptions will exist in the ConfigMgr console.

2017-06-05 22_06_53-System Center Configuration Manager (Connected to CMR - SCCM 2012 R12 - CMR Netw.jpg

Now head to the Intune portal at and login with your tenancy admin account.

Click Admin\Mobile Device Management. You’ll note that no MDM authority exists for Intune. Click Set Mobile Device Management Authority.

2017-06-05 22_12_29-Microsoft Intune.jpg

This will set Intune to the MDM authority.

2017-06-05 22_14_56-Microsoft Intune.jpg

You’ll note above that the iOS and Mac OS X section reports that No APNs certificate was uploaded. We will now address this to be able to manage these devices.

Note that for the APN we need to renew the existing certificate that was being used in hybrid Intune in ConfigMgr. If we do not use the same certificate then all devices will have to become unenrolled and then reenrolled. 

In the Microsoft Intune console, go to Administration\Mobile Device Management\iOS and Mac OS X and click Upload an APNs Certificate.

2017-06-05 22_25_33-Microsoft Intune_ iOS Mobile Device Management Setup.jpg

Next select Download the APNs Certificate Request and save the .csr file.

2017-06-05 22_25_57-Microsoft Intune_ Upload an APNs Certificate.jpg

Connect to and sign in with the account that manages your Apple APNs.

2017-06-05 22_21_54-Apple Push Certificates Portal.jpg

Select the correct APN certificate and click Renew.

2017-06-05 22_23_54-Apple Push Certificates Portal.jpg

Select the .csr file saved locally and click the Upload button.

2017-06-05 22_31_50-Apple Push Certificates Portal.jpg

Once the Upload completes, you will be presented with a Download button, click this to download the APNs .pem certificate. Save this file locally.

2017-06-05 22_32_05-Apple Push Certificates Portal.jpg

Back in the Intune console, click the Upload the APNs Certificate button.

2017-06-05 22_32_45-Microsoft Intune_ Upload an APNs Certificate.jpg

Browse locally to where the .pem file was saved and enter the Apple ID that is used to manage the Apple APN certificates. Click Upload.

2017-06-05 22_33_29-Microsoft Intune_ Upload an APNs Certificate.jpg

iOS and Mac OS X devices will be ready for enrollment.

2017-06-05 22_33_46-Microsoft Intune_ iOS Mobile Device Management Setup.jpg

Devices will now be informed of the change in MDM authority and this process will be seamless with no interruption to the management of the devices.

I recommend you take a look at the full list of Next Steps from the Microsoft documentation to make your transition as smooth as possible.



One comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s