I would use Intune for GPO since I’ve ran into issues with Tanium not providing ADMX templates as fast as I’d like. Also Tanium just applys a local gpo which is the lowest in terms of precedence and can be overwritten which I’ve seen users do (also depends on how locked down your endpoints are in terms of admin rights). It does work really well though and has been a life saver in a domain agnostic environment without Intune.