Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
There is no single “deploy SCCM client through Intune” procedure. The supported method depends on the device’s starting state. Existing Configuration Manager clients should normally be enabled for co-management and automatic Intune enrollment—not reinstalled. New Microsoft Entra-joined Windows devices can receive the client through an Intune Co-management settings policy, particularly in Windows Autopilot deployments. Custom internet-based scenarios may use ccmsetup.msi as an Intune app, with the installation parameters generated by Configuration Manager.
This guide covers the decision, prerequisites, commands, deployment methods, validation, and common failures.
What “SCCM client through Intune” means
SCCM is the former name for Microsoft Configuration Manager. Its endpoint agent is the Configuration Manager client. Intune does not replace ccmsetup.exe; it delivers or invokes the bootstrap process.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCo-management means that a Windows device has both:
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
- The Configuration Manager client, registered with a Configuration Manager site.
- Microsoft Intune MDM enrollment.
Administrators can then decide which workloads remain with Configuration Manager and which move to Intune. Intune enrollment alone does not make a device co-managed. The client must install successfully, communicate with the site, and receive co-management policy. See Microsoft’s co-management overview.
Choose the correct deployment path
| Starting state | Recommended path |
|---|---|
| Existing Configuration Manager-managed, hybrid-joined Windows devices | Enable co-management and automatic Intune enrollment from Configuration Manager. |
| New Microsoft Entra-joined Windows Autopilot devices | Use the Intune Co-management settings policy to automatically install the client. |
| New internet-based devices that need Configuration Manager | Use the co-management bootstrap/client-installation workflow with CMG connectivity. |
| Intune-only devices becoming Configuration Manager clients | Install the client with the appropriate internet-based command, then allow co-management enrollment. |
| A device already has a healthy client | Do not redeploy it merely to enroll the device into Intune; configure co-management instead. |
Microsoft describes two principal co-management paths: existing Configuration Manager clients enrolling into Intune, and new internet-based devices enrolling into Intune first and then receiving the Configuration Manager client. Review the Microsoft co-management enrollment paths before choosing a method.
Prerequisites checklist
Licensing and permissions
Plan for appropriate Intune and Microsoft Entra licensing. Microsoft lists Microsoft Entra ID P1 or P2 and Intune licensing among the co-management prerequisites; EMS subscriptions may include both, depending on the agreement. Confirm current licensing terms for your tenant, region, and commercial channel.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The administrators performing the work also need suitable permissions in Configuration Manager, Intune, and Microsoft Entra ID.
Configuration Manager and CMG
- Use a supported Configuration Manager current branch release.
- Connect the Configuration Manager site to Microsoft cloud services through cloud attach/co-management.
- Configure a Cloud Management Gateway (CMG) when internet-based clients must install or communicate without a traditional internal management point.
- Onboard the tenant and verify the tenant information used by Configuration Manager.
- Configure a management point and client content distribution appropriate to the chosen path.
- Ensure the CMG certificate chain and required root certificates are trusted by the device.
A CMG is not automatically required for every existing, internally connected client, but it is central to many remote and internet-based installation scenarios. Microsoft documents the Microsoft Entra authentication workflow and CMG requirements.
Device identity and Intune enrollment
Do not treat these identity states as interchangeable:
- Microsoft Entra joined: common for new cloud-first and Autopilot devices.
- Microsoft Entra hybrid joined: the expected identity state for the documented existing-client co-management path.
- Microsoft Entra registered/workplace joined: registration alone does not satisfy the existing-client co-management path.
Verify that Intune is the MDM authority where applicable, automatic MDM enrollment is configured, the correct MDM user scope or device-token enrollment setting is enabled, enrollment restrictions allow the device, and the target is included in the enrollment scope. Assign co-management policy to a pilot device group unless a deliberate user-based design is required.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Windows 10 reached end of support on October 14, 2025. New deployments should be evaluated primarily against supported Windows 11 scenarios and the organization’s current Configuration Manager support baseline.
Obtain the client command from Configuration Manager
Do not copy a hard-coded CMG command from an example or another environment. The CMG hostname, CMG identifier, site code, tenant configuration, and authentication settings are environment-specific.
- Open the Configuration Manager console.
- Open the cloud attach or co-management properties.
- Go to the Enablement or client-installation area.
- Copy the generated client installation command-line parameters.
- Use those parameters in the Intune Co-management settings policy or supported bootstrap method.
A typical internet-based command resembles the following, but it is only a pattern:
CCMHOSTNAME=CMG.CONTOSO.COM/CCM_Proxy_MutualAuth/<CMG_IDENTIFIER> SMSSITECODE=ABCMicrosoft documents CCMHOSTNAME and SMSSITECODE as important properties for an internet-based, Microsoft Entra-authenticated installation. Configuration Manager installation syntax generally places CCMSetup.exe parameters before client MSI properties:
CCMSetup.exe [CCMSetup parameters] [client.msi setup properties]For example, /mp:SMSMP01 and /logon are CCMSetup parameters, while SMSSITECODE=S01 is a client property. See Microsoft’s client installation parameters and properties.
Method 1: Use the Intune Co-management settings policy
This is the preferred method for supported new Intune-enrolled devices and Autopilot co-management workflows because it avoids unnecessary MSI packaging and lifecycle management.
Create and assign the policy
- Open the Microsoft Intune admin center.
- Go to Devices.
- Select Enroll devices.
- Select Windows enrollment.
- Open Co-management settings.
- Select Create, then provide a policy name and optional description.
- On the settings page, select Yes to automatically install the Configuration Manager client.
- Paste the generated Configuration Manager command-line parameters.
- Assign the policy to a small pilot device group.
- For Autopilot, assign the appropriate Windows Autopilot deployment profile and Enrollment Status Page profile to the relevant device group.
Microsoft’s documented portal path and Autopilot procedure are described in How to enroll with Windows Autopilot.
Rank #3
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
What happens after assignment
- The device enrolls into Intune.
- The co-management policy instructs the device to install the Configuration Manager client.
- Intune downloads and runs the
ccmsetup.msibootstrap. - The
CCMSETUPCMDvalue passes the Configuration Manager parameters toccmsetup.exe. - In supported internet-based scenarios, the client obtains content through the CMG.
- The client installs, registers with the site, and applies co-management policy.
These stages are asynchronous. A device may appear in Intune before the Configuration Manager client is installed or before co-management policy has finished processing.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Autopilot and Enrollment Status Page
The Autopilot Enrollment Status Page (ESP) can wait for Configuration Manager client installation and registration. The documented default ESP timeout is 60 minutes, although the tenant policy can change it.
Keep the initial provisioning workflow focused on critical applications. A large number of applications or a lengthy task sequence can delay registration and increase the risk of an ESP timeout. Install noncritical software after enrollment where possible.
Method 2: Package ccmsetup.msi as an Intune app
Use this method for custom workflows or scenarios that are not well served by the built-in co-management policy. It is not the universal or default solution for Autopilot.
Use the correct bootstrapper
Microsoft documents ccmsetup.msi in the Configuration Manager site installation files, commonly under the site server’s bini386 location. The exact path depends on the installation.
Do not package client.msi for direct installation. Microsoft states that client.msi cannot be installed directly; ccmsetup.exe is the bootstrapper that stages prerequisites and the required client files. The MSI method uses ccmsetup.msi to invoke that bootstrap process.
Pass parameters through CCMSETUPCMD
A conceptual silent installation command is:
msiexec /i ccmsetup.msi CCMSETUPCMD="CCMHOSTNAME=CMG.CONTOSO.COM/CCM_Proxy_MutualAuth/<CMG_IDENTIFIER> SMSSITECODE=ABC" /qnReplace every environment-specific value with the command generated by your Configuration Manager console. Keep the quotation marks around CCMSETUPCMD, and remember that Intune limits the command line to 1,024 characters.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
For an Intune app deployment:
- Use the correct
ccmsetup.msifrom the intended Configuration Manager environment. - Pass the installation parameters through
CCMSETUPCMD. - Use a reliable detection rule.
- Assign the app to a pilot device group.
- Prevent another Configuration Manager or Intune deployment from installing a different client version simultaneously.
Design detection around the desired outcome
MSI presence alone proves very little. Depending on the purpose of the app, detection may check:
- The Configuration Manager client installation directory and version.
- The Configuration Manager client service.
- An appropriate registry value or bootstrap product code.
- A script that confirms installation and expected registration state.
Separate “installed” from “healthy,” “registered,” and “co-managed.” A detection rule should answer the exact question your deployment needs to answer.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsExisting Configuration Manager clients: do not reinstall them
For a healthy existing client, the normal sequence is:
- Configure Microsoft Entra hybrid join.
- Configure Microsoft Entra Connect and device synchronization as required.
- Configure Configuration Manager cloud attach and co-management.
- Configure automatic Intune enrollment.
- Select a pilot collection or pilot device group.
- Confirm that devices enroll into Intune.
- Pilot workload movement.
- Expand deployment gradually.
This path uses the client already present on the device. Reinstalling it through Intune can create duplicate reporting, version drift, unnecessary repair operations, and confusing detection results. Follow Microsoft’s existing-client co-management procedure.
Move workloads carefully
Co-management does not mean moving every management function to Intune immediately. Relevant workload areas include:
- Compliance policies
- Device configuration
- Windows Update policies
- Endpoint Protection
- Client applications
- Resource access policies
Configuration Manager remains authoritative for workloads that have not been switched. Intune becomes authoritative for workloads explicitly moved to it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a pilot collection and move one workload at a time. Avoid deploying the same application from both platforms without a deliberate design. Also avoid contradictory security baselines and configuration profiles, and do not use both the Configuration Manager provider and Intune Management Extension for the same ordered application workflow when ordering matters. Microsoft’s workload troubleshooting guidance covers provider conflicts.
Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Verify installation, registration, and co-management separately
On the device
- Open Control Panel → Configuration Manager.
- On the General tab, confirm an assigned management point.
- On the Network tab, confirm the internet-based management point or CMG configuration where applicable.
- Run
dsregcmd /statusand confirm the identity state matches the selected deployment path.
In the portals
- Confirm the device appears in Intune as enrolled.
- Confirm it appears in the Configuration Manager console.
- Confirm the assigned site and management point are correct.
- Confirm the workload authority matches the pilot design.
Review logs
Important locations are:
%WinDir%ccmsetupLogsccmsetup.log
%WinDir%ccmsetupLogsclient.msi.log
%WinDir%CCMLogsCoManagementHandler.log
%WinDir%CCMLogsCcmAAD.logccmsetup.log: bootstrap, prerequisites, downloads, and installation.client.msi.log: MSI-level installation actions.CcmAAD.log: Microsoft Entra token activity.CoManagementHandler.log: enrollment and co-management processing.LocationServices.logandCcmMessaging.log: site and management-point communication.
Also inspect the DeviceManagement-Enterprise-Diagnostics-Provider administrative event log for automatic enrollment failures.
Troubleshoot by failure stage
The client does not install
Start with ccmsetup.log, not the Intune status alone. Check whether the failure is a prerequisite evaluation, content download, certificate trust, command-line, or MSI problem. Microsoft documents these CCMSetup return codes:
| Code | Meaning |
|---|---|
0 |
Success |
6 |
Error |
7 |
Reboot required |
8 |
Setup already running |
9 |
Prerequisite evaluation failure |
10 |
Setup manifest hash validation failure |
The return code is only a starting point; the log contains the actionable error.
The device is Intune-managed but not co-managed
Installation, site registration, Microsoft Entra authentication, MDM enrollment, and co-management policy processing are separate stages. Review ccmsetup.log, CcmAAD.log, and CoManagementHandler.log. Then verify site assignment, the management point, Intune enrollment scope, and the event log mentioned above.
The CMG cannot be reached
Check the CMG hostname and identifier, internet reachability, tenant onboarding, management-point configuration, certificate chain, and root CA availability. The device must be able to validate the CMG server authentication certificate. A client may install successfully but remain unregistered if it cannot authenticate or communicate afterward.
The command fails
Common errors include omitting CCMHOSTNAME, using a CMG path from another hierarchy, using the wrong site code, placing properties incorrectly, omitting the CCMSETUPCMD quotation marks, or exceeding Intune’s 1,024-character limit. Re-copy the generated command from the current Configuration Manager console rather than repairing an old example manually.
The device is only Microsoft Entra registered
Run:
dsregcmd /statusConfirm that the identity state meets the selected route. A registered-only workplace device is not a substitute for the hybrid-joined state required by the documented existing-client path. New internet-based devices should follow the separate Intune-first workflow.
ESP times out
Reduce the number of applications and task-sequence actions required during ESP. Keep only critical provisioning actions in the initial phase and deploy remaining software after enrollment. Also verify that the client can reach the CMG and complete registration.
PKI prevents the workflow
PKI remains an option for some client communication designs, but Microsoft documents limitations, including that Autopilot into co-management is not supported using PKI certificates in the referenced troubleshooting guidance. Enhanced HTTP and Microsoft Entra authentication may be a better fit for a modern internet-based design, subject to your security requirements and Configuration Manager support state.
Quick Recap
Alternatives and when they fit
- Configuration Manager client push: suitable for reachable, domain-connected devices; not a general solution for internet-only devices.
- Group Policy startup deployment: useful in traditional domain environments.
- Software update point installation: possible in suitable Configuration Manager environments with different prerequisites.
- Task sequence deployment: useful when client installation must immediately trigger provisioning or application work.
- Intune-only management: better when the organization is retiring Configuration Manager and no longer needs its workloads.
- Tenant attach: provides Configuration Manager visibility and actions in the Intune admin center, but it does not itself enroll a device into Intune or make it co-managed.
Deployment checklist
- Identify whether the device already has a healthy Configuration Manager client.
- Confirm Microsoft Entra joined, hybrid joined, or registered identity state.
- Verify supported Configuration Manager, Intune, Windows, licensing, and permissions prerequisites.
- Configure cloud attach, co-management, automatic enrollment, and CMG where required.
- Copy the current generated command from Configuration Manager.
- Use the Co-management settings policy by default for supported new-device scenarios.
- Package
ccmsetup.msionly for a justified custom workflow. - Assign to a pilot device group.
- Verify installation, site registration, authentication, MDM enrollment, and workload authority separately.
- Move workloads gradually and eliminate conflicting assignments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
