Security and Privacy

Executive Summary

Opsole Migrate is an enterprise Windows device modernization platform that transitions devices from Active Directory (AD) Joined, Hybrid Microsoft Entra ID Joined, or Microsoft Entra Tenant-to-Tenant states into a clean Microsoft Entra ID Joined state without reimaging, while preserving the existing Windows operating system state and user profile experience

Opsole Migrate is designed to maintain the device’s operating system state and the user’s existing profile environment as-is, by ensuring profile continuity under the new device identity through controlled system-level ownership and permission alignment.

Opsole Migrate does not read, inspect, scan, or copy user file contents. The platform does transmit limited device and identity metadata required for licensing, operational telemetry, and (where enabled) recovery assurance.

---

What Opsole Migrate Does and Does Not Do

Opsole Migrate operates strictly at the system configuration layer, not the data layer. This aligns with the common “in-place” profile continuity approach used by established workstation migration process.

---

System Integrity and Profile Continuity Principle

Opsole Migrate is designed so that:

• The Windows OS state remains unchanged (no reimage / no reset)

• The existing profile folder and contents remain intact

• Profile continuity is achieved by allowing Windows to continue using the existing profile under the new identity context

In other words: the user retains the same working environment (apps, data, settings) because the profile is preserved in place, rather than being copied or recreated.

Data Categories Collected and Why

Opsole Migrate follows a purpose-limited telemetry model.

Operational Metadata

Used to identify devices, track execution state, and support troubleshooting.

• Device hostname

• Device serial number

• Migration status / phase state

• Execution logs and error codes

Identity Mapping Metadata

• Used to correlate the existing profile to the correct identity context.

• User SID

• Username (as applicable for operational mapping)

Recovery Assurance Secrets (Optional / Conditional)

Collected to support recovery paths when a device becomes inaccessible due to system issues during change.

• BitLocker recovery key (backup/recovery scenario)

• LAPS / Windows LAPS password (break-glass recovery scenario)

Important: Opsole Migrate does not use these values to access user content; they exist to enable device recovery if the endpoint becomes inaccessible.

Security Controls for Sensitive Recovery Data

Because BitLocker keys and LAPS passwords are sensitive, Opsole Migrate treats them as high-risk secrets.

Recommended enterprise-grade controls (and expected customer review topics) include:

• Encryption in transit between endpoint and backend services

• Encryption at rest for any stored secrets or logs

• Strict access control (role-based, least privilege)

• Audit logging for access to sensitive recovery secrets

• Support access governance (only authorized personnel, for documented recovery cases)

This mirrors the general pattern used by major vendors that store migration logs and artifacts for troubleshooting with encryption and retention controls

Data Processing Transparency

Opsole Migrate operates as a limited-scope data processor strictly for the purpose of enabling device transition, operational telemetry, and recovery assurance.

Processing Activities

• Collection of device and identity metadata required for execution

• Secure storage of recovery secrets for support scenarios

• Diagnostic logging for troubleshooting and audit

Data Handling Principles

• Encrypted transmission (TLS)

• Encrypted storage at rest

• Role-based access control

• Time-bound retention aligned with support requirements

• No sharing with third parties

Microsoft Entra App Registration and Permissions

Opsole Migrate uses a customer-consented Microsoft Entra application to perform required device lifecycle operations.

Typical permission needs in this category include:

• Device management actions in Intune (including cleanup of stale objects as required)

• Read access to limited Entra user properties (for identity correlation and operational validation)

Security Principles

• The app registration exists in the customer tenant

• The customer maintains full visibility and administrative control

• Permissions are used for operational device management only

• The customer can revoke permissions at any time

Data Privacy Positioning

User Content Data

Opsole Migrate does not process user content (documents, emails, browser history, file contents).

Device & Identity Metadata

Opsole Migrate processes limited metadata required for operational execution, auditability, and support.

Regulatory Alignment

This design supports customer privacy and compliance expectations because:

• No user content is inspected or transferred

• Telemetry is purpose-limited and operationally justified

• Sensitive recovery data (where enabled) is treated as protected secrets

Reliability, Success Dependencies, and Customer Expectations

Opsole Migrate is designed to reduce disruption and preserve profile continuity; however, success is influenced by endpoint conditions such as:

• Windows OS integrity and disk health

• Existing profile health (corruption, encryption constraints, damaged profile state)

• Endpoint security controls (EDR/AV blocks, hardening policies, credential protections)

• Network constraints (proxy, allowlisting, connectivity)

Opsole Migrate preserves the profile in place and does not modify user content.

If the endpoint environment prevents required system-level operations, migration may not complete as intended and may require controlled recovery actions.

(Enterprise tools commonly communicate similar boundaries—e.g., “in-place profile handling” while noting conditions where recovery is required.)

Migration Success Dependencies and Limitations

Opsole Migrate is designed to preserve the existing Windows profile and operating system state. However, successful profile usability after migration depends on several environmental factors outside the control of the software.

Success Factors (Customer Environment)

• Healthy Windows OS and disk integrity

• Valid and non-corrupted user profile state

• Proper endpoint security allowlisting where required

• Network connectivity during Entra join operations

• Availability of BitLocker and LAPS recovery information

Important Limitation

Opsole Migrate preserves the existing profile in place and does not modify user data. If the source system contains profile corruption, OS damage, or security software blocks required system operations, migration may not complete as intended and may require controlled recovery procedures.

Opsole Migrate does not guarantee recovery from pre-existing system or profile corruption.

Shared Security Responsibility Model

Successful device transition requires coordination between Opsole Migrate capabilities and customer environment readiness.

Opsole Responsibilities

• Secure execution of device transition workflow

• Secure handling of recovery credentials

• Telemetry, logging, and auditability

• Recovery guidance and documentation

Customer Responsibilities

• Ensure device backups prior to migration

• Ensure OS and profile health before execution

• Configure endpoint security exclusions if required

• Provide administrative privileges on target devices

• Ensure stable network connectivity for Entra operations

• Maintain access to BitLocker and LAPS recovery mechanisms

Interaction with Endpoint Security Products (EDR/AV)

Opsole Migrate performs system-level operations which may be monitored or blocked by EDR/AV products.

Security posture principles:

• No evasion or bypass behavior

• Transparent execution and logging

• Customer-controlled security allowlisting policies where required

Compliance and Security Certifications

Opsole Ltd operates under audited information security and quality management systems.

These certifications validate Opsole’s controls around data protection, access control, encryption, incident response, and operational governance.

Incident Response and Security Governance

Opsole maintains formal incident detection and response procedures aligned with ISO 27001 and SOC 2 controls.

• Continuous monitoring of platform services

• Defined incident response procedures

• Customer notification in line with regulatory expectations

• Controlled access to sensitive operational data

• Periodic security reviews and audits

Summary Security Statement

Opsole Migrate modernizes device identity to Microsoft Entra ID Join while preserving the existing Windows OS state and user profile in place. It does not access or migrate user file contents. The platform securely collects limited operational metadata and, where enabled, recovery assurance secrets (BitLocker/LAPS) strictly for supportability and break-glass recovery.