Québec Ministry of Cybersecurity and Digital Technology (MCN)

SUP-03 — Diagnosing and resolving incidents on Windows endpoints under SCCM/Intune co-management

A diagnostic method for co-managed Windows 10/11 endpoints: identity and enrollment, SCCM client state, Intune sync, policy assignment, workloads, client cycles, logs and re-evaluation.

Period: July 2023 – present
My role: Modern Workplace systems engineer (consultant)
Organization: Québec Ministry of Cybersecurity and Digital Technology (MCN)

SCCM / MECM
Microsoft Intune
Windows 10/11
Microsoft Entra ID
PowerShell
Co-management

On this page

Recruiter summary
Co-management context and objectives
Documented responsibilities
Architecture A — Microsoft co-management
Architecture B — Policy flows
Architecture C — SCCM client cycles
Architecture D — Incident diagnostic tree
Logs and technical diagnostics
Resolution procedures — documentary framework
Demonstrated skills and limits

Recruiter summary

SUP-03 makes visible the method used to diagnose incidents on Windows 10/11 endpoints under SCCM/MECM and Microsoft Intune co-management at the MCN: synchronization issues, analysis of co-managed devices, SCCM client-cycle diagnostics and policy/client-state verification. The starting point is always the same: establish which platform owns the relevant workload, then verify the real policy path to its final endpoint status.

Complementary, conceptual case study. SUP-03 complements the application-deployment studies and is not a production view. Diagrams illustrate Microsoft mechanisms generically; they disclose no MCN co-management setting, tenant, group, server, collection, compliance threshold or actual workload configuration.

Co-management context and objectives

Co-management enables a Windows endpoint to be administered by both the SCCM/MECM client and Microsoft Intune, with workloads divided between those management planes. It does not mean every setting is applied twice: for every incident, the expected mechanism — SCCM client policy or Intune MDM policy — must be identified before interpreting missing configuration, non-compliance or failed application installation.

Objectives are to confirm expected device identity, join and enrollment; verify SCCM client health, policy reception and evaluation; verify Intune synchronization, policy assignment and MDM status; distinguish SCCM from Intune mechanisms; establish technical evidence; then conduct authorized correction and re-evaluation.

Documented responsibilities

Diagnosing synchronization problems.
Analyzing co-managed devices.
Diagnosing SCCM client cycles.
Verifying policy and client status.

These activities are part of Modern Workplace N2/N3 support. This page does not claim to describe an MCN-specific topology or configuration; it explains a diagnostic logic applicable to a co-managed environment.

Architecture A — Microsoft co-management

Mermaid diagram of conceptual co-management: SCCM/MECM site and Management Point, Microsoft Entra ID, Microsoft Intune, co-managed Windows endpoint and generic workload split. Policy and status flow between endpoint and each management plane. — **Complementary management planes.** SCCM/MECM and Intune each communicate with the co-managed endpoint; the relevant workload determines the mechanism to diagnose. Open Mermaid-exported SVG

Prerequisites, identity and enrollment

Check	What it establishes	Careful interpretation
Microsoft Entra ID identity	Device join state and identity	Existing identity alone does not prove policy receipt
MDM enrollment	Presence of an Intune management relationship	Enrollment is correlated with sync and assignment
SCCM client	Service, assignment and client health	An installed client does not guarantee current policy
Connectivity	Reachability of services needed by the mechanism	A network failure can explain stale status, not automatically every error

Checks are performed with authorized tools and access. No credential, service URL, tenant name or internal setting is included in this documentation.

Architecture B — Policy flows

Mermaid policy-flow diagram: targeted assignment supplies either SCCM client policy or Intune Entra ID assignment and MDM sync. The co-managed endpoint evaluates and applies configuration based on workload, then returns status to SCCM or Intune. — **Two flows not to confuse.** The diagram separates SCCM assignment/status return from Intune assignment, MDM synchronization and status return. Open Mermaid-exported SVG

Policy diagnostic method

Qualify the symptom: missing endpoint, non-compliance, policy not applied or application not installed.
Determine the expected workload without assuming its actual switch in the tenant or site.
Check targeting: SCCM collection/policy or Intune group/assignment, as appropriate.
Verify receipt: SCCM client policy or Intune MDM synchronization.
Verify local evaluation and application: client, context, prerequisite and, for applications, detection rule.
Read status and logs chronologically, then isolate the documented cause.
Apply authorized correction and verify outcome after a new evaluation or synchronization.

Architecture C — SCCM client cycles

Mermaid diagram of four SCCM cycles: Machine Policy Retrieval and Evaluation, Application Deployment Evaluation, Software Updates Scan and Hardware Inventory, each paired with a diagnostic check. — **SCCM cycles and associated evidence.** A cycle triggers or accelerates a focused evaluation; it does not replace validation of targeting, connectivity or configuration. Open Mermaid-exported SVG

SCCM cycle	Role	Associated checks
Machine Policy Retrieval & Evaluation	Requests and evaluates available client policy	Policy receipt, targeting, client status and policy logging
Application Deployment Evaluation	Re-evaluates known application deployments	Deployment presence, detection rules, install state and application logs
Software Updates Scan	Refreshes evaluation of applicable updates	Expected source, scan results, prerequisites and update state
Hardware Inventory	Collects and transmits defined client inventory	Trigger, collected data and inventory-status return

A cycle runs only under the appropriate procedure and permissions. It is not presented as an automatic solution: cause analysis precedes a focused retry.

Architecture D — Incident diagnostic tree

Mermaid diagnostic decision tree: missing, non-compliant or policy-not-applied endpoint; check identity and enrollment, SCCM state/connectivity, Intune synchronization/assignment, then SCCM or Intune branch, validated correction and new evaluation. — **Conceptual decision tree.** The incident is separated by expected mechanism before SCCM cycles/logs or Intune MDM/compliance diagnostics are inspected. Open Mermaid-exported SVG

Logs and technical diagnostics

Domain	Items to inspect	Purpose
SCCM policy and location	`PolicyAgent.log`, `LocationServices.log`, `ClientLocation.log`	Confirm policy retrieval/evaluation and client ability to locate expected services
SCCM applications	`AppIntentEval.log`, `AppDiscovery.log`, `AppEnforce.log`	Separate intent, detection and application execution
SCCM content	`CAS.log`, `ContentTransferManager.log`	Check location, preparation and content transfer for application incidents
Windows MDM / Intune	Sync state, assignments, policy report, Windows MDM logs and Intune Management Extension logs when relevant	Link endpoint, policy, execution and status return without reducing analysis to one console
Compliance	Authorized visible state/criteria and policy dependencies	Establish whether the gap affects evaluation, state return or configuration itself

Log names are generic SCCM diagnostic references. Their presence and interpretation depend on client version, deployment type and scenario. No extract from an MCN endpoint is published.

Resolution procedures — documentary framework

Symptom	Check sequence	Possible documented resolution
Endpoint missing or non-compliant	Identity, join, enrollment, sync, assignment, status return	Correct the identified cause under the authorized procedure, then synchronize/re-evaluate
Intune synchronization failure	MDM state, connectivity, last exchange, assignment and relevant logs	Restore validated prerequisite or assignment; verify fresh state without assuming automatic re-enrollment
Policy not applied	Identify workload, check targeting, receipt and evaluation	Correct documented targeting or prerequisite, then trigger the appropriate evaluation
Application not installed	Separate SCCM/Intune flow; check intent, content, command and detection	Follow relevant log and apply validated package, content or detection correction
SCCM client or communication issue	Client health, services, location, policy and connectivity	Escalate or correct within authorized scope, then verify fresh policy and state

Demonstrated skills and limits

Area	Demonstration
Microsoft co-management	Separate reading of SCCM/MECM and Intune planes and workload allocation
SCCM / MECM	Client-cycle, policy, status, location, inventory and relevant-log diagnostics
Microsoft Intune	MDM synchronization, Entra ID assignments, policy, compliance and status returns
Windows 10/11	Identity, join, enrollment, management client and local diagnostics
PowerShell	Diagnostic checks and collection in authorized procedures
N2/N3 support	Qualification, technical evidence, controlled correction, re-evaluation and documentation

Documented work covers synchronization diagnosis, co-managed-device analysis, SCCM cycles and policy/client-state checks.
Four diagrams are Mermaid sources exported to SVG and retained in contenu/projets/sup03/.
No MCN workload setting, server, tenant, group, production scenario, metric or volume is invented; metrics are not published as they are the organization’s operational data.