MEMCM Management of Bitlocker with Co-Management enabled

Question

Good morning,
I am piloting MEMCM\Intune co-management for a group of hybrid-joined devices. We are also in the middle of migrating our MBAM management of some of these devices from a standalone infrastructure to MEMCM-integrated. For any machine that isn't in the Pilot group, the migration goes fine, I see the machine show up in the DB and it shows compliance status properly in the MEMCM reports. For any machine that is in the Pilot group, the Compliance Status Details show as "Policy is not enforced" If I look at the BitlockerManagementHandler.log on those clients, I see multiple entries of this type:

Security workload is not SCCM managed; ignoring policy.

We do have an Endpoint Management\Disk Encryption Policy configured, but I have removed the deployment to those machines, and yet the MEMCM Bitlocker policy will still not enforce.

Is MEMCM-integrated Bitlocker management supported for Co-managed devices and if so is there a specific workload that must not be Pilot-Intune assigned in order for the MEMCM policies to take effect?

Any help is welcome.

Answer 1

If you have moved the Endpoint Protection work load to Intune, then this will move BitLocker and Defender to Intune as well.

Answer 2

So MEMCM-integrated MBAM and Intune are incompatible? We're likely going to be staying with a hybrid Intune\MEMCM environment and would prefer to have Bitlocker managed by MEMCM, is there no way to specifically exclude Bitlocker from the Endpoint workload?

Answer 3

No this is not possible.