How to move Intune-managed devices to a new tenant

Record each device's platform, serial number, owner type, primary user and join type so you can assign it to a wave. Install the module first if needed (install Microsoft Graph PowerShell) and consent to the scopes when the browser asks.

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","DeviceManagementServiceConfig.Read.All"
Get-MgDeviceManagementManagedDevice -All |
  Select-Object DeviceName,OperatingSystem,OSVersion,SerialNumber,ManagedDeviceOwnerType,DeviceEnrollmentType,UserPrincipalName,AzureAdDeviceId |
  Export-Csv C:\migration\intune-devices.csv -NoTypeInformation

List Autopilot devices with their group tags. You will need the serial numbers to deregister them and the group tags to recreate targeting in the target.

Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
  Select-Object SerialNumber,Model,GroupTag,EnrollmentState |
  Export-Csv C:\migration\autopilot-devices.csv -NoTypeInformation

Pair each device with its user's migration wave. A device should move on the same day its user starts signing in with the target account. Keep each day under the Wipe and Retire limits in Step 9.

Microsoft lists an Intune subscription, Windows automatic enrolment and a Microsoft Entra ID P1 or P2 subscription as requirements for Autopilot. Under MDM user scope select All, or Some and pick the migrating user groups, then select Save. Set enrolment restrictions in the target Intune admin center so the platforms you are moving are allowed.

Select Deployment Profiles > Create Profile > Windows PC, name it, set Deployment mode to User-driven and Join to Microsoft Entra ID as to Microsoft Entra joined, assign it to your device groups under Included groups and select Create. Then select Enrollment Status Page > Create, set Show app and profile configuration progress to Yes and assign it. If you use group tags, create dynamic device groups in the Entra admin center that match the same tags (rule shown below) so imported devices pick up the right profile.

(device.devicePhysicalIds -any (_ -eq "[OrderID]:Sales"))

Recreate compliance policies, configuration profiles, endpoint security policies (including BitLocker and FileVault), update rings and Conditional Access, using your source documentation. Assign them to the same groups. Point Conditional Access at the target device compliance state.

Re-upload Win32 and line-of-business packages, and add Microsoft Store, Apple VPP and managed Google Play apps in the target. Assign them to the same groups. Mark the apps users need at first sign-in as blocking apps in the Enrollment Status Page.

Create the Apple MDM push certificate on the Apple tab, then the ADE token under Enrollment program tokens, following Microsoft's linked set-up pages. Then select the token > Enrollment policies > Create policy > iOS/iPadOS (and macOS if needed). Return to Enrollment program tokens, select the token and choose Set Default Policy, pick the policy and select Save. Create the default early: Microsoft says a synced Apple device with no enrolment policy fails enrolment.

Connect the target tenant to managed Google Play (Microsoft's "Connect your Intune account to your Android Enterprise account" page). Under Android Enterprise > Enrollment Profiles choose Corporate-owned, fully managed user devices (or dedicated, or corporate-owned work profile) and select Create policy. Select the profile, then Token, to see the token and export it.

A wipe removes all local data and Microsoft says it cannot be recovered. Confirm Known Folder Move is redirecting Desktop, Documents and Pictures to OneDrive and that OneDrive content has been migrated to the target. See OneDrive cross-tenant migration.

Microsoft says to back up the BitLocker recovery key and local administrator credentials before retiring or deleting an Entra-joined device. Export keys from the source Entra ID while the device records still exist. Save to a folder only you can read.

Connect-MgGraph -Scopes "BitlockerKey.Read.All"
Get-MgInformationProtectionBitlockerRecoveryKey -All |
  ForEach-Object {
    $k = Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $_.Id -Property key
    [pscustomobject]@{ DeviceId = $_.DeviceId; KeyId = $_.Id; Created = $_.CreatedDateTime; Key = $k.Key }
  } | Export-Csv C:\secure\bitlocker-keys.csv -NoTypeInformation

List the key protectors to match the key ID with your export.

manage-bde.exe -protectors -get C:

Store the key file in a secured location with restricted access and delete it once devices are re-encrypted in the target. Record where it is and who can open it.

The script comes from the PowerShell Gallery; the commands below install and run it. The output CSV holds the serial number, product ID and hardware hash. Full steps, including the direct upload option: export an Autopilot hardware hash. Type Y if asked to install NuGet.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory -Path "C:\HWID"
Set-Location -Path "C:\HWID"
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Install-Script -Name Get-WindowsAutopilotInfo
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

Combine hashes into files of up to 500 rows. Microsoft requires the exact header, no extra columns, no quotation marks and ANSI text. Edit in Notepad, not Excel, because Excel produces a file that cannot be imported. Add the group tag in the Group Tag column if you use one. Save with Encoding: ANSI.

Device Serial Number,Windows Product ID,Hardware Hash,Group Tag,Assigned User
<serialNumber>,<ProductID>,<hardwareHash>,<optionalGroupTag>,<optionalAssignedUser>

Microsoft recommends Partner Center for most Autopilot registrations. If your reseller or OEM registers devices for you, ask them to move registrations to the target tenant instead of collecting hashes yourself.

In the action row select Remove data > Wipe, leave both options unticked (No options selected) so all data, accounts and enrolment are removed, and select Wipe to confirm. Tell the user to leave the device at the first setup screen once it restarts. Users can also run Reset this PC from Settings.

Note the device's Serial number, then select Delete in the toolbar and Yes to confirm.

Search by serial number and tick the device. Select ... at the end of the row and choose Unassign user if it is available, then OK. With the device still ticked, select Delete and Yes. Select Sync, then Refresh every few minutes until the device disappears.

For Entra-joined devices, Microsoft says no extra steps are needed and to avoid manually deleting the device from Microsoft Entra ID. For hybrid-joined devices, delete the computer object from on-premises AD DS so it does not resync.

Select Import in the toolbar, browse to the CSV and select Import. When the import finishes, select Sync and Refresh until the devices appear. Confirm each batch registered before importing the next.

Wait until each device shows Profile status Assigned. Then the user restarts or continues setup, signs in with the target account and the Enrollment Status Page applies policies and apps.

Microsoft says a device deleted from Intune but still assigned to the ADE token reappears on the next full sync. In Apple Business Manager, sign in as an Administrator or Device Enrollment Manager, select Devices, search for the serial numbers and select them, choose Edit next to Edit MDM Server, choose Assign to Server and pick the MDM server linked to the target token, then Continue twice. In the target Intune, select the token, then Devices > Sync.

Confirm the devices show in the target with an enrolment policy assigned. Microsoft notes that changes to an ADE enrolment policy only take effect after the device is reset.

Wipe the device from the source Intune, or retire it and reset it with the Settings app or Apple Configurator. Setup Assistant then enrols it into the target. With Await final configuration set to Yes, the user sees a locked screen until Intune applies configuration policies.

If the target uses a different Apple Business Manager organisation, the source must release the device. Microsoft says Release from Organization cannot be undone. Agree with your Apple reseller how each device will be added to the target organisation before you release it.

Select Retire and Yes. The user removes the management profile if it remains (Settings > General > VPN & Device Management on iOS), then enrols with Company Portal signed in with the target account.

Microsoft lets you delete an ADE token only when no devices or enrolment policies are assigned to it. After the last device has moved, select the token > Devices and delete any remaining devices, then Enrollment policies and delete them (including the default), then return, select the token and select Delete.

Fully managed, dedicated and corporate-owned work profile devices are wiped from the source, then enrolled with the target enrolment profile token or QR code from Step 3. Intune supports bulk wipe of up to 100 of these devices per action: on Basics choose Android and Wipe.

Wipe is not supported for personally owned work profile devices. Retire them, which removes the work profile data, apps and settings, then ask the user to sign in to Company Portal with the target account.

Microsoft says Wipe on Zebra Android devices removes only corporate data and does not factory reset, and that Samsung fully managed devices with Factory Reset blocked lose contact with Intune during a wipe. Check these models before you start and plan a manual factory reset where needed.

Microsoft says a tenant can submit up to 500 Wipe actions and 1,000 Retire actions per day, counting individual, bulk and Graph requests. Size device waves within these limits.

Move devices after the user's target account is active, licensed and has its mailbox and OneDrive in place. Before that, the user has nothing to sign in to.

Move a handful of devices for each platform and enrolment type through the full sequence before the first production wave. Record how long each step took.

After setup, confirm the device is joined to the target tenant.

dsregcmd /status

Check the device's Compliance column shows Compliant, then open Recovery keys and confirm a BitLocker recovery key is listed for the device.

Once target keys are escrowed, delete the exported source keys according to your security policy, and record the date.

Delete any remaining source Intune and Autopilot records. Intune cleanup rules can remove device records that have not checked in for a set period, but Microsoft says they do not remove Entra device records.