This page defines the technical, identity, network, security, and operational prerequisites that must be completed before running Opsole Migrate on production devices.

Do not begin production migration until every required prerequisite has been validated on representative pilot devices.

With Opsole Migrate, you can:

• Migrate devices from Active Directory Joined to Microsoft Entra ID Joined
• Convert Hybrid Microsoft Entra ID Joined devices to cloud-only Microsoft Entra ID Joined
• Perform Tenant-to-Tenant device migrations for mergers, acquisitions, divestitures, and tenant consolidation

All without:

• Reimaging or wiping devices
• Losing user profiles, configurations, or local data
• Requiring users to rebuild their Windows environment after migration

1. Opsole Migrate Pre-Migration Readiness

Before deploying Opsole Migrate, ensure that the following prerequisites are met for all migration scenarios — whether AD-to-Entra, Hybrid-to-Entra, and Tenant-to-Tenant migrations. These requirements must be satisfied in the appropriate source and destination tenants to provide a secure and reliable migration experience.

1.1 Licensing Requirements

Each user and device involved in the migration process must have the required Microsoft licenses assigned.

Tenant-to-Tenant note: Licenses must exist in both the source tenant and the target tenant so devices remain compliant during transition and can enroll after Microsoft Entra ID Join.

Licenses must be active and assigned before migration.

1.2 Supported Device Management States

Opsole Migrate supports devices in the following starting states:

1.3 Environment Dependencies

Opsole Migrate depends on the successful operation of Microsoft Windows 10/11, Microsoft Entra ID, Microsoft Intune, provisioning packages, network connectivity, endpoint security controls, and overall customer environment readiness to complete the migration process successfully. If conditions prevent required operations from completing successfully, migration cannot continue until those conditions are resolved within the environment.

Opsole Support provides assistance with product-related issues, migration behavior, migration log analysis, and identification of conditions affecting the migration process. Environmental and infrastructure conditions affecting Microsoft Entra join, Windows profile access, networking, endpoint security, operating system behavior, or other customer-managed dependencies must be resolved within the customer environment before migration can continue.

1.4 Client Device Technical Requirements

All client devices must meet the following minimum hardware, software, and state requirements.

Devices not meeting these minimum specifications may experience performance degradation, compatibility issues, or migration failure.

1.4 Network Requirements

To enable a smooth and uninterrupted migration experience, the network used by devices must meet the following requirements:

• Support outbound HTTPS port 443

• Allow system-level outbound HTTPS without prompting the user for proxy authentication

• Avoid proxy configurations that require interactive user authentication

• Avoid captive-portal networks during migration; hotel, airport, and guest Wi-Fi captive portals cannot complete non-interactive OAuth and provisioning flows

• Allow DNS resolution for Microsoft and Opsole service endpoints

• Allow device registration and join from the device's current network location

• Allow outbound access to the following Microsoft and Opsole service endpoints:

  • https://*.microsoft.com
  • https://*.msazure.cn
  • https://*.microsoftonline.com
  • https://*.microsoftonline-p.com
  • https://*.microsoftonline.us
  • https://*.microsoftonline.de
  • https://*.microsoftonline.cn
  • https://*.amazonaws.com
  • https://*.opsole.com

Network Connectivity Validation

Before starting migration activities, verify that client devices can successfully reach required Microsoft and Opsole service endpoints.

Run the following commands on a client device using PowerShell:

Test-NetConnection graph.microsoft.com -Port 443
Test-NetConnection login.microsoftonline.com -Port 443
Test-NetConnection migrate-adminus.opsole.com -Port 443
Test-NetConnection amigrate-admineu.opsole.com -Port 443

Confirm that each command returns:

TcpTestSucceeded : True

About hosting and regions: Opsole backend services are hosted on AWS. Regional hosting options, where available, are confirmed during onboarding and documented in the customer's security pack. If your egress proxy filters by destination IP rather than FQDN, request the current IP ranges from Opsole Support.

1.5 Identity & Access Readiness

To successfully deploy and manage AD-to-Entra, Hybrid-to-Entra, and Tenant-to-Tenant migrations, access and configuration must be in place across Microsoft Entra ID, Active Directory where applicable, and Microsoft Intune.

Microsoft Entra ID Administrative Roles

An administrator with sufficient Microsoft Entra privileges is required to register the application, create the client secret, assign Microsoft Graph application permissions, and grant admin consent.

Common roles involved include:

• Global Administrator
• Privileged Role Administrator
• Cloud Application Administrator or Application Administrator

Your organization may require separate approval for granting tenant-wide application permissions.

Active Directory Access Requirements

An account with delegated permissions to disjoin devices from Active Directory is required when migrating AD-joined or Hybrid-joined devices.

The minimum delegated permissions on the OU containing the target computer objects are:

• Delete on Computer objects
• Read all properties on Computer objects

The detailed account creation and validation procedure is covered in AD Disjoin Account Preparation.

Microsoft Entra ID and Intune Configuration Requirements

The following table lists the Microsoft Entra ID and Intune configuration requirements for device migration using Opsole Migrate.

• For AD-to-Entra and Hybrid-to-Entra migrations, apply these settings in the tenant the device will join after migration.
• For Tenant-to-Tenant migrations, apply these settings in the target destination tenant, and review source-tenant policies that may affect cleanup or API operations.

Misconfiguration of these settings can prevent devices from joining or enrolling during AD-to-Entra, Hybrid-to-Entra, or Tenant-to-Tenant migrations.

Conditional Access and MFA Requirements

Automated device join and provisioning package execution use non-interactive flows. Policies that require interactive MFA, compliant device state, trusted network location, or hybrid-joined state can block migration.

Review and scope exclusions for:

• Bulk enrollment / package account
• Device registration and join
• Microsoft Graph application authentication
• Target tenant enrollment
• Cross-tenant access restrictions, where applicable

Review every Conditional Access policy that enforces any of the following:

• MFA for device registration or join
• Compliant device requirement
• Hybrid-joined device requirement
• Trusted-location requirement
• Approved-client-app requirement
• Sign-in or user risk controls
• Blocking legacy or unknown platforms
• Cross-tenant restrictions

All exclusions should be time-bound, documented, and removed after the migration window.

1.6 Required Microsoft Graph API Permissions

The Opsole Migrate application requires Microsoft Graph application permissions to perform device management, user lookup, identity correlation, Intune cleanup, recovery, and post-migration assignment operations.

• For AD-to-Entra and Hybrid-to-Entra migrations, configure these permissions in the tenant where the migration operations are performed.
• For Tenant-to-Tenant migrations, configure the permissions in both the source and target tenants.

Only grant permissions required for the enabled migration features. Feature-dependent permissions are required only when the corresponding capability is enabled, such as LAPS retrieval, group restoration, or configuration profile handling.

These permissions require Admin Consent during the application registration process in Microsoft Entra ID.

1.7 Provisioning Package Planning

The following tool is required to support provisioning package creation and validation:

• Windows Configuration Designer (WCD) Used to create Windows bulk enrollment provisioning packages.

Download Windows Configuration Designer from the Microsoft Store.

The migration depends on a Windows bulk enrollment provisioning package (.ppkg) generated against the Microsoft Entra tenant the device will join. The package itself is created later in Provisioning Package Configuration, but the constraints below must be planned now.

The provisioning package should be treated like a credential because it contains a bulk enrollment token. Access must be restricted to migration administrators only.

Validate the package before uploading it to the Opsole Migrate portal by applying it to a non-production standalone Windows device and confirming AzureAdJoined : YES using dsregcmd /status.

1.8 Configure Security Software Exclusions

Opsole Migrate performs system-level operations for migration and post-migration cleanup - that endpoint security tooling will inspect closely. Without explicit allow-listing, it is common for an EDR, antivirus, WDAC, AppLocker, or hardening policy to block, quarantine, or delete components mid-migration.

The exclusions must be deployed and verified on representative devices that reflect production conditions.

What to Allow-list

Apply all three exclusions below.

Code-signing Certificate Trust

Trust the Opsole code-signing certificate so that all signed components are recognized as legitimate without behavioral-analysis triggers.

• Subject: CN=Opsole Ltd, O=Opsole Ltd, ...
• Issuer, SHA-256 thumbprint, and validity: provided in the certificate-trust pack delivered to your security team during onboarding. If you have not received it, contact Opsole Support.

File-system Path Exclusions

Exclude the Opsole Migrate runtime directories from real-time analysis and on-write scanning:

• C:\Program Files\Opsole\OpsoleMigrate\
• C:\ProgramData\OpsoleMigrate\
• C:\ProgramData\OpsoleMigrate\runtime\
• C:\ProgramData\OpsoleMigrate\logs\

Also confirm that:

• Application-control, WDAC, and AppLocker policies allow Opsole-signed binaries to execute.
• Controlled folder access in Microsoft Defender does not block writes to the runtime and logs paths above.

1.9 Recovery Readiness

Before migration, confirm that support teams have a recovery path if a device becomes inaccessible.

1.9 Application Readiness

Before production rollout, validate business-critical applications on pilot devices to confirm they function correctly after migration. Applications that bind configuration, credentials, certificates, or tokens to the existing domain or tenant identity may require reauthentication or reconfiguration post-migration. Opsole recommends engaging your application owners and internal teams to complete this validation before broad deployment.

1.10 Prerequisite Scope by Migration Scenario

2. Prerequisites for Opsole Migrate

Once all pre-migration readiness requirements are confirmed, complete the following configuration tasks in your environment. Each prerequisite is covered in a dedicated guide.

• Entra Application Registration Register the Opsole Migrate application in Microsoft Entra ID, assign the required Microsoft Graph permissions, and grant admin consent.

• Provisioning Package Generate a Windows bulk enrollment provisioning package against the target Entra tenant and upload it to the Opsole Migrate portal.

• AD Disjoin Account Create a delegated Active Directory account with the minimum permissions required to disjoin devices from the domain. Required for AD-joined and Hybrid-joined migrations.

All three prerequisites must be completed and validated before proceeding to Portal Onboarding.

Next Steps

• Continue to Entra Application Registration