Glossary
Group Policy (GPO)
Group Policy is the Active Directory mechanism that pushes thousands of Windows settings to domain-joined machines and users through policy objects linked to organizational units. It still runs most on-premises Windows estates, but it only reaches devices that can see a domain controller, which is why fleets with remote and hybrid workers move the same settings to MDM configuration service providers.
How it works
A Group Policy Object is a container of settings stored on the domain controllers, linked to a site, domain or organizational unit. The client pulls it: a domain-joined machine applies computer policy at boot, user policy at logon, then refreshes roughly every 90 minutes with a random offset of up to 30 minutes. Settings come from ADMX templates, and conflicts resolve by precedence, with the closest link usually winning. Microsoft shipped this with Windows 2000 and has barely changed the plumbing since.
Two conditions are non-negotiable. The device must be domain-joined, and it must have network line of sight to a domain controller, directly or through a VPN. A laptop that spends three months on home Wi-Fi and a coffee shop hotspot never refreshes its policy. Nobody notices until an audit asks when that machine last received its password policy.
The MDM equivalent is the Policy CSP. Configuration service providers are the interfaces Windows exposes to a management server over the OMA-DM protocol, and they work over the internet with no domain membership. Microsoft now adds new Windows settings to the Policy CSP first, which reverses the old order of things. Intune's Group Policy analytics will ingest a GPO backup in XML and tell you, setting by setting, what has an MDM equivalent and what does not, and the settings catalog is where you rebuild the ones that do.
Why it matters for a fleet
The honest comparison: Group Policy is deeper, MDM is reachable. GPO covers tens of thousands of settings plus logon scripts, drive mappings, printer deployment and fine-grained legacy controls that simply have no CSP. If you run a factory floor where every PC sits on the corporate LAN, GPO is not a problem to solve.
MDM wins the moment devices stop coming back to the office. Policy arrives over HTTPS, applies on a machine that was enrolled by Autopilot and never joined a domain, and reports back whether it actually landed. That reporting gap is the thing GPO admins underestimate: Group Policy tells you what you configured, not what applied.
Most organizations end up co-managed for a while, and that is fine as long as you set precedence deliberately. By default, when a setting exists in both worlds, MDM wins on a co-managed Windows device, and you can flip that behavior per device. Pick one source of truth per setting area instead of letting the two fight.
How Appaloosa handles it
Appaloosa manages Windows through the same native MDM channel, so password rules, encryption, update behavior and app delivery are configured from the console and evaluated continuously rather than assumed. Devices enroll with Windows Autopilot, and the available policies are described on the Windows MDM page. For estates that still need deep legacy GPO settings, keeping those on the domain while moving security baselines and app distribution to MDM is a reasonable split.
Explore
See the full platform
Enrollment, apps, security, remote support: all in one place.
Explore Appaloosa →See Appaloosa run on your fleet Book a demo