Migration guide: Set up or move to Microsoft Intune

After you planned for the move to Microsoft Intune, the next step it to choose the migration approach that's right for your organization. These decisions depend on your current mobile device management (MDM) environment, business goals, and technical requirements.

This migration guide lists and describes your options to adopt or move to Intune, which include:

• You don't use a mobile device management solution
• You use a third party partner MDM solution
• You use Configuration Manager
• You use on-premises group policy
• You use Microsoft 365 Basic Mobility and Security

Use this guide to determine the best migration approach, and get some guidance & recommendations.

Before you begin

• Microsoft Intune is a cloud native solution that helps manage identities, devices, and apps. If your goal is to become cloud native, then you can learn more at the following articles:

  • Learn about cloud-native endpoints
  • What is Intune?

• Your Intune deployment might be different from a previous MDM deployment. Intune uses identity-driven access control. It doesn't require a network proxy to access organization data from devices outside your network.

Currently don't use anything

If you currently don't use any MDM or mobile application management (MAM) provider, then you have some options:

• Microsoft Intune: If you want a cloud solution and ready for full device management, then go straight to Intune. You can use Intune to check for compliance, configure device features, deploy apps, and install system & app updates. You also get the benefits of the Microsoft Intune admin center, which is a web-based console.

  • App protection policies overview
  • Get started with Intune
  • Step 1 - Set up Intune
  • Step 2 - Add, configure, and protect apps with Intune
  • Step 3 – Plan for compliance policies
  • Step 4 - Create device configuration profiles to secure devices
  • Step 5 - Enroll devices

• Configuration Manager: If you want the features of Configuration Manager (on-premises) combined with Intune (cloud), then consider tenant attach (in this article) or co-management (in this article).

  Configuration Manager can:

  • Manage on-premises Windows Server and some client devices.
  • Manage partner or third party software updates.
  • Create custom task sequences when deploying the Windows operating system.
  • Deploy and manage many app types.

Currently use a third party MDM provider

Devices should only have one MDM provider. If you use another MDM provider, like Workspace ONE (previously called AirWatch), MobileIron, or MaaS360, then you can move to Intune.

Users must unenroll their devices from the current MDM provider before they enroll in Intune.

1. Set up Intune, including setting the MDM Authority to Intune.

   For more information, go to:

   • Get started with your Microsoft Intune deployment
   • Step 1 - Set up Intune.

2. Deploy apps and create app protection policies. The idea is to help protect organization data in your apps during the migration and until devices are enrolled & managed by Intune.

   For more information, go to Step 2 - Add, configure, and protect apps with Intune.

3. Unenroll devices from the current MDM provider.

   When devices are unenrolled, they aren't receiving your policies, including policies that provide protection. The devices are vulnerable until they enroll in Intune and start receiving your new policies.

   Give users specific unenroll steps. Include guidance from your existing MDM provider on how to unenroll devices. Clear and helpful communication minimizes end user downtime, dissatisfaction, and helpdesk calls.

4. Optional, but recommended. If you have Microsoft Entra ID P1 or P2, also use Conditional Access to block devices until they enroll in Intune.

   For more information, go to Step 3 – Plan for compliance policies.

5. Optional, but recommended. Create a baseline of compliance and device settings that all users and devices must have. These policies can be deployed when users enroll in Intune.

   For more information, go to:

   • Step 3 – Plan for compliance policies
   • Step 4 - Configure device features and settings to secure devices and access resources
   • Levels of protection and configuration in Microsoft Intune

6. Enroll in Intune. Be sure you give users specific enrollment steps.

   For more information, go to:

   • Step 5 – Enroll devices in Microsoft Intune
   • Intune enrollment deployment guide

Recommendations:

• If you're moving from a partner MDM/MAM provider, then note the tasks you're running and the features you use. This information gives an idea of what tasks to also do in Intune.

• Use a phased approach. Start with a small group of pilot users, and add more groups until you reach full scale deployment.

• Monitor the helpdesk load and enrollment success of each phase. Leave time in the schedule to evaluate success criteria for each group before migrating the next group.

  Your pilot deployment should validate the following tasks:

  • Enrollment success and failure rates are within your expectations.

  • User productivity:

    • Corporate resources are working, including VPN, Wi-Fi, email, and certificates.
    • Deployed apps are accessible.

  • Data security:

    • Review compliance reports, and look for common issues and trends. Communicate issues, resolutions, and trends with your help desk.
    • Mobile app protections are applied.

• When you're satisfied with the first phase of migrations, repeat the migration cycle for the next phase.

  • Repeat the phased cycles until all users are migrated to Intune.
  • Confirm the helpdesk is ready to support end users throughout the migration. Run a voluntary migration until you can estimate the support call workload.
  • Don't set deadlines for enrollment until your helpdesk can handle all remaining users.

Helpful information:

• Get started with Intune
• Intune enrollment deployment guide
• Step 1 - Set up Intune and your tenant

Currently use Configuration Manager

Configuration Manager supports Windows Servers, and Windows & macOS client devices. If your organization uses other platforms, you might need to reset the devices, and then enroll them in Intune. Once enrolled, they receive the policies and profiles you create. For more information, see the Intune enrollment deployment guide.

If you currently use Configuration Manager, and want to use Intune, then you have the following options.

Option 1 - Add tenant attach

Tenant attach allows you to upload your Configuration Manager devices to your organization in Intune, also known as a "tenant". After you attach your devices, you use the Microsoft Intune admin center to run remote actions, like sync machine and user policy. You can also see your on-premises servers, and get OS information.

Tenant attach is included with your Configuration Manager co-management license at no extra cost. It's the easiest way to integrate the cloud (Intune) with your on-premises Configuration Manager setup.

For more information, see enable tenant attach.

Option 2 - Set up co-management

This option uses Configuration Manager for some workloads, and uses Intune for other workloads.

1. In Configuration Manager, set up co-management.
2. Set up Intune, including setting the MDM Authority to Intune.

Devices are ready to be enrolled in Intune, and receive your policies.

Helpful information:

• What is co-management?
• Co-management workloads
• Switch Configuration Manager workloads to Intune
• Configuration Manager product and licensing FAQ

Option 3 - Move from Configuration Manager to Intune

Most existing Configuration Manager customers want to keep using Configuration Manager. It includes services that are beneficial for on-premises devices.

These steps are an overview, and are only included for those users who want a 100% cloud solution. With this option, you:

• Register existing on-premises Active Directory Windows client devices as devices in Microsoft Entra ID.
• Move your existing on-premises Configuration Manager workloads to Intune.

This option is more work for administrators, but can create a more seamless experience for existing Windows client devices. For new Windows client devices, we recommend you start from scratch with Microsoft 365 and Intune (in this article).

1. Set up hybrid Active Directory and Microsoft Entra ID for your devices. Microsoft Entra hybrid joined devices are joined to your on-premises Active Directory, and registered with your Microsoft Entra ID. When devices are in Microsoft Entra ID, they're also available to Intune.

   Hybrid Microsoft Entra ID support Windows devices. For other prerequisites, including sign-in requirements, see Plan your Microsoft Entra hybrid join implementation.

2. In Configuration Manager, set up co-management.

3. Set up Intune, including setting the MDM Authority to Intune.

4. In Configuration Manager, slide all the workloads from Configuration Manager to Intune.

5. On the devices, uninstall the Configuration Manager client. For more information, see uninstall the client.

   Once Intune is set up, you can create an Intune app configuration policy that uninstalls the Configuration Manager client. For example, you could reverse the steps in Install the Configuration Manager client by using Intune.

Devices are ready to be enrolled in Intune, and receive your policies.

Option 4 - Start from scratch with Microsoft 365 and Intune

This option applies to Windows client devices. If you use Windows Server, such as Windows Server 2022, then don't use this option. Use Configuration Manager.

To manage your Windows client devices:

1. Deploy Microsoft 365, including creating users and groups. Don't use or configure Microsoft 365 Basic Mobility and Security.

   Helpful links:

   • Microsoft 365 Enterprise deployment guide
   • Set up Microsoft 365 Business

2. Set up Intune, including setting the MDM Authority to Intune.

3. On existing devices, uninstall the Configuration Manager client. For more information, see uninstall the client.

Devices are ready to be enrolled in Intune, and receive your policies.

Currently use on-premises group policy

In the cloud, MDM providers, like Intune, manage settings and features on devices. Group policy objects (GPO) aren't used.

When you manage devices, Intune device configuration profiles replace on-premises GPO. Device configuration profiles use settings exposed by Apple, Google, and Microsoft.

Specifically:

• On Android devices, these profiles use the Android Management API and EMM API.
• On Apple devices, these profiles use the Device management payloads.
• On Windows devices, these profiles use the Windows configuration service providers (CSPs).

When moving devices from group policy, use Group policy analytics. Group Policy analytics is a tool and feature in Intune that analyzes your GPOs. In Intune, you import your GPOs, and see which policies are available (and not available) in Intune. For the policies that are available in Intune, you can create a settings catalog policy using the settings you imported. For more information on this feature, go to Create a Settings Catalog policy using your imported GPOs in Microsoft Intune.

Next, Step 1: Set up Microsoft Intune.

Currently use Microsoft 365 Basic Mobility and Security

If you created and deployed Microsoft 365 Basic Mobility and Security policies, then you can migrate the users, groups, and policies to Microsoft Intune.

For more information, go to Migrate from Microsoft 365 Basic Mobility and Security to Intune.

Tenant to tenant migration

A tenant is your organization in Microsoft Entra ID, like Contoso. It includes a dedicated Microsoft Entra service instance that Contoso receives when it gets a Microsoft cloud service, like Microsoft Intune or Microsoft 365. Microsoft Entra ID is used by Intune and Microsoft 365 to identify users and devices, control access to the policies you create, and more.

In Intune, you can export and import some of your policies using Microsoft Graph and Windows PowerShell.

For example, you create a Microsoft Intune trial subscription. In this subscription trial tenant, you have policies that configure apps and features, check compliance, and more. You'd like to move these policies to another tenant.

This section shows how to use the Microsoft Graph scripts for a tenant to tenant migration. It also lists some policy types that can or can't be exported.

Download the samples, and run the script

This section includes an overview of the steps. Use these steps as guidance, and know that your specific steps might be different.

1. Download the samples, and use Windows PowerShell to export your policies:

   1. Go to microsoftgraph/powershell-intune-samples, select Code > Download ZIP. Extract the contents of the .zip file.

   2. Open the Windows PowerShell app as administrator, and change the directory to your folder. For example, enter the following command:

      cd C:\psscripts\powershell-intune-samples-master

   3. Install the AzureAD PowerShell module:

      Install-Module AzureAD

      Select Y to install the module from an untrusted repository. The install can take a few minutes.

   4. Change the directory to the folder with the script you want to run. For example, change the directory to the CompliancePolicy folder:

      cd C:\psscripts\powershell-intune-samples-master\powershell-intune-samples-master\CompliancePolicy

   5. Run the export script. For example, enter the following command:

      .\CompliancePolicy_Export.ps1

      Sign in with your account. When prompted, enter the path to put the policies. For example, enter:

      C:\psscripts\ExportedIntunePolicies\CompliancePolicies

   In your folder, the policies are exported.

2. Import your policies in your new tenant:

   1. Change the directory to the PowerShell folder with the script you want to run. For example, change the directory to the CompliancePolicy folder:

      cd C:\psscripts\powershell-intune-samples-master\powershell-intune-samples-master\CompliancePolicy

   2. Run the import script. For example, enter the following command:

      .\CompliancePolicy_Import_FromJSON.ps1

      Sign in with your account. When prompted, enter the path to the policy .json file you want to import. For example, enter:

      C:\psscripts\ExportedIntunePolicies\CompliancePolicies\PolicyName.json

3. Sign in to the Intune admin center. The policies you imported are shown.

What you can't do

There are some policy types that can't be exported. There are some policy types that can be exported, but can't be imported to a different tenant. Use the following list as a guide. Know there are other policy types that aren't listed.

Next steps

• Get started with Intune
• Enrollment deployment guides