Stabilizing endpoint deployments under SCCM and Intune co-management

Context

The Québec Ministry of Cybersecurity and Digital Technology runs a Windows 10 and 11 fleet managed through SCCM and Intune co-management. In that model some workloads stay with SCCM while others move to Intune: synchronization gaps between the two consoles produce installations that fail without a clear message for the user, and devices that look compliant in one console and non-compliant in the other.

Requests and incidents arrive through ServiceNow, with the documentation and escalation requirements expected in a government environment.

Scope: Windows 10/11 fleet managed under SCCM and Intune co-management in a ministry environment.

My role

Modern Workplace systems engineer, assigned as a Micro Logic consultant. I own level 2 and 3 incidents and requests covering application deployment, device compliance, identity and remote access, working directly with the cybersecurity, IAM, network and infrastructure teams.

Actions and tools

• Deployment failure diagnosis from SCCM status messages, client logs and installer return codes, to separate a packaging issue from a targeting, dependency or device issue.
• Forcing and analyzing SCCM client cycles: Machine Policy Retrieval, Application Deployment Evaluation, Software Updates Scan and Hardware Inventory, to bring a device back in sync with its management point.
• Resolving co-management synchronization issues between SCCM and Intune: devices missing from one console, workloads switched incorrectly, inconsistent compliance state.
• SCCM/MECM administration: application deployment, upgrade and removal, collection creation and targeted deployments.
• Deploying and tracking Windows security updates to keep the fleet compliant, supported by Defender, BitLocker and LAPS.
• Active Directory operations for lookup, diagnosis and support on accounts and objects, using SuperConsole AD and RSAT.
• PowerShell scripts for silent installation, version validation and remediation, written to be reused by other teams rather than to fix a single device.
• Systematic documentation in ServiceNow and the knowledge base: installation procedure, resolution method, associated script.

Result

• Root causes of deployment failures are identified at the source (package, targeting, client cycle or co-management) instead of being bypassed with a manual reinstall.
• PowerShell remediation scripts and written procedures are reused by support teams, which reduces escalations for the same symptom.
• Non-compliant devices are brought back into compliance through a documented, repeatable fix.
• Resolution time: tracked case by case according to priority, scope and technical dependencies.
• Incidents handled: N2/N3 incidents and requests documented in ServiceNow under the established process.
• Deployment success: verified from deployment status and client checks, with no internal rate published.

Visuals and evidence

Conceptual diagrams and diagnostic procedures document the method without publishing screenshots, server names, IP addresses or internal personal data.