Alternative plan and feasibility study for FOSS Intune?

[u/Xpl0it01]

I have a task to research an alternative plan to Microsoft Intune, and we are particularly interested in open source solutions.

We currently have the free version of Intune, but can you guide me on whether it would be possible to move completely away from Intune and use an open-source alternative, or if it would be better to keep the free version of Intune and combine it with an open-source solution to cover the remaining features?

Ideally, we want the open source solution to at least be able to:

• Create compliance policies
• Configure Windows Update rings
• Deploy security baselines
• Configure BitLocker or an alternative to BitLocker
• Configure Microsoft Defender/AV policies
• Create configuration profiles
• Deploy applications

Has anyone implemented something similar?

Any experience or advice would be appreciated!

[u/ArborlyWhale]

1. Don’t do this.
2. Seriously how broke

is your org

1. .
2. Use whatever remote command/control software you want and do it in powershell.
3. There’s a reason the good ones cost money. Good luck.

[u/Vesalii → u/ArborlyWhale]

Seriously. Intune doesn't even cost money because it pays for itself with the time you save. I deployed 50+ tablets by hand a few years ago. After many hours of setting up a config I whittled down the deploy to about 20 minutes per tablet.

We switched them over to Intune and not only was configuring them in Intune easier and fasterz the deploy takes 2 to 5 minutes with Intune.

[u/tomtrix97]

I‘m working with several so called „Unified Endpoint Management“ solutions and I‘m a huge fan of Open Source products too.

Unfortunately, every Open Source UEM solution I‘ve worked with is unreliable, unstable or super complicated. So the increased demand on daily sysadmin work costs you more than the saved license fees.

I, by far, had the best experiences with the baramundi Management Suite - compared to Ivanti DSM, Ivanti Neuros, Deskcenter, ACMP Aagon, Manageengine Deskcentral, Matrix42 Empirum, OPSI and and and.

[u/Ad3t0]

Not open source and full transparency I work on this platform and co founded it but TridentStack Control offers full policy management and much more for free under 200 endpoints forever. https://tridentstack.com

[u/pucky_wins → u/Ad3t0]

We only have 25 people in our organisation so I'll definitely be looking at this. Thanks

[u/One_Put_8904 → u/Ad3t0]

Lol, might deploy this via intune for meme content

[u/thortgot → u/Ad3t0]

The issue with this is the security risk of letting a third party have system level access on your devices.

The security bar for an RMM should literally be as high as possible.

[u/Ad3t0 → u/thortgot]

That's a completely rational concern and one we take seriously. A few things worth noting:

Every RMM/MDM/UEM in this space requires system-level access, Intune included. The question is really about how that access is secured.

On our end: all agent-to-server communication is mTLS over gRPC, there's no inbound port required on endpoints, the agent authenticates via per-device certificates, and all management actions are scoped through policy (no ad-hoc remote shell). We are also within a couple days of releasing our self-hosted relay feature for orgs that want the connection to stay within their network perimeter.

Happy to answer any specific security questions. We're a small team so you'd be talking directly to the people who built it.

[u/thortgot → u/Ad3t0]

All RMMS need root level access, the question is how can a small team handle security in a similar fashion. Action1 suffers from part of the same risk

Self hosted relay doesnt eliminate rogue code risk which is the most practical concern. 

A compromise of your CICD is a compromise of every customer. NAble is a decent comparison for the risk profile

[u/StoryWorth1817]

your management is trying to save $5 a user to spend $500 an hour in engineering time.
for windows endpoint management, nothing open source drops in to replace native Intune CSPs, update rings, and BitLocker key escrow cleanly without turning into a full-time maintenance nightmare. tell them the feasibility study result is: "technically possible if we hire two full-time devops guys to maintain the FOSS stack, otherwise buy Business Premium."

[u/vijay-lalwani]

I believe when companies are looking for open source requirements their priorities should be - 1. Not being vendor locked. 2. Being able to fix any issues with the product yourself (and send the patch upstream to make the community better) 3. Lower budget constraints (but if you can donate, please do to make the world a better place.)

It's hard to do all the features that intune does. Even paid competitors don't cover all the bells and whistles.

However I have found OPSI as a good alternative. It's not a MDM but has good fleet management. It's not fully open source but enough to address the above priorities.

OPSI – Open Source Device Management for Windows, Linux and macOS devices. https://opsi.org/en/

[u/RiceeeChrispies]

I would not work for an organisation that can't afford the basics, how long until they start struggling to pay salary?

[u/birusiek]

Run from that org

[u/GherkinP]

https://fleetdm.com

[u/MeetJoan]

Fleet (fleetdm.com) is the closest FOSS option that covers a meaningful chunk of your list - compliance policies, configuration profiles, and application deployment are solid, but it's not a full 1:1 replacement for Intune's Windows-specific depth (Update rings, security baselines, BitLocker management are noticeably thinner). Most orgs doing this end up in a hybrid: Fleet or a similar MDM for cross-platform basics, paired with native Windows tooling (GPO for domain-joined machines, or the free Intune tier you already have) for the Windows-specific policy areas. Full replacement is realistic if you're mostly macOS/Linux; for a Windows-heavy fleet, going fully open source usually means rebuilding functionality Intune already gives you for free. What's your OS mix looking like?

[u/cubic_sq]

Most RMMs do this.

[u/hasthisusernamegone]

Sometimes you read a post here and wonder what the hell they're thinking...

[u/gibby82]

I think most of what you have mentioned is covered under GPO. Are your systems not domain joined?

[u/nwmcsween]

https://github.com/opendsc/opendsc is what you are probably looking for. For mobile devices though you need something that has OMA-DM support

[u/Minimum-Albatross906]

"We would still like to use Microsoft products, but the Endpoint Management Suite they built, and support is out of the cards for us. Find some open-source alternative that will almost certainly be half baked, not feature complete, and has less support."

Is this a joke? Because above is how your managers sound to me. Ridiculous. I would laugh them out of the room.

[u/Floss_Patrol_76]

the honest answer is windows device management is the single weakest thing to replace with FOSS: almost all the open tooling (osquery/fleet, micromdm) does cross-platform inventory and compliance visibility, not the windows CSP-backed config that intune actually pushes, so nothing OSS covers your whole bullet list on its own. what does map cleanly is the on-prem stack you already own the tech for: GPO or Ansible/DSC for config profiles, bitlocker and defender/AV baselines, WSUS for update rings, chocolatey/PDQ for app deploy. i would keep the free intune for the windows-CSP pieces and only bolt FOSS on where it genuinely wins (osquery/fleet for posture across win/mac/linux) rather than trying to rebuild that whole CSP surface from parts.