SCCM Co-Management No More

As you are probably aware, the SCCM 1902 update rollup made a change in their co-management and coexistence compatibility capability:

If an SCCM-managed device is enrolled into an MDM server other than Intune (i.e., Workspace ONE or any other third-parties), the SCCM agent reverts to a read-only mode which essentially  killed a  number of third-party co-management (or coexistence in Microsoft’s terms) scenarios. According to Microsoft this was done to avoid potential conflicts device management conflicts

On November 2019,   Microsoft Endpoint Manager was introduced to the world, announcing that Microsoft not only is combining all of its endpoint management tools into the new platform but it is all about enabling customers to co-management with SCCM and Intune in a new cloud-based management.

Workspace ONE for Microsoft Endpoint Manager?

Shortly after, VMware made the announcement of a new product, Workspace ONE for Microsoft Endpoint Manager and recommended it to be used in customer scenarios where SCCM is in use.   VMware’s Shanker Iyer wrote, “Workspace ONE will build value on top of Microsoft Endpoint Manager for management of Windows 10 devices.”

The first round of features all appear to be about using Workspace ONE Intelligent Hub on top of MEM, and Shanker highlighted newer features like the employee onboarding experience, and Digital Employee Experience Management. Apps managed by MEM can show up in Intelligent Hub, and customers can use Workspace ONE Tunnel. VMware expects a preview to be out in early 2020.

According to Brian Madden in the “Definitely Not Official VMware EUC Podcast – Episode 5” podcast,   under Workspace ONE for MEM, MEM will be doing the actual device management, via whatever combination of SCCM and Intune you want.  VMware will take their Windows agent, which can both act as the management authority and do a bunch of other things (like analytics, security, user experience, crash reporting, baseline configuration reporting, etc.) and make it so that it can be just do all of the latter tasks. So when it comes to device management, the VMware agent gets out of the way, and lets MEM do the management.

Summary: Two types of Customers:

Those who want to stay with SCCM (now named: Microsoft Endpoint Configuration Manager) and those who do not.

For customers that do want to go ahead and have their modern device management authority on Windows 10 be anything other than MECM/ Intune, they will need to decommission MECM.