Overview
macOS |
Windows |
Linux |
iOS/iPadOS |
Android |
|---|---|---|---|---|
Yes |
Yes |
Yes |
No |
No |
Prerequisite: an existing MDM, Active Directory with Group Policy, or an equivalent tool that can push packages to your devices.
One catch on macOS. The agent installs silently, but the enrolment profile still has to be accepted by the employee. If you want a genuinely touchless result on Macs, use zero touch instead.
How to use
Deploy through an existing tool
- Go to Devices > Enrol devices and select the operating system.
- Copy the package or download the installer.
- Distribute it through your existing tool — Jamf, Intune, SCCM or similar — as a silent install.
The agent checks in on its own once installed.
Migrate Windows from another MDM
Turn on Windows MDM Automatic Migration in Settings > MDM. Windows devices enrolled with another MDM then migrate by themselves, with no manual re-enrolment.
If you are coming from Intune, do this first:
- Set the new MDM as the external MDM in Entra, from your MDM settings page for Windows automatic enrolment.
- Switch automatic enrolment away from Intune. Go to entra.microsoft.com, search for Mobility, select Intune, set both options to None and save.
- Migrate the devices. One at a time: enrol the device and it appears as "On in another MDM" — use the migration button. Or all at once: upload the migration script to Controls > Scripts, create a policy with the detection query, and link the script to the policy.
The migration script removes the old enrolment from the registry and re-triggers enrolment:
```powershell
$EnrollmentsPath = "HKLM:\SOFTWARE\Microsoft\Enrollments\"
$Enrollments = Get-ChildItem -Path $EnrollmentsPath
$DiscoveryServerFullUrls = @("INPUTURLHERE")
ForEach ($Enrollment in $Enrollments) {
$EnrollmentObject = Get-ItemProperty Registry::$Enrollment
if ($EnrollmentObject."DiscoveryServiceFullURL" -in $DiscoveryServerFullUrls ) {
$EnrollmentPath = $EnrollmentsPath + $EnrollmentObject."PSChildName"
Remove-Item -Path $EnrollmentPath -Recurse
& "C:\Windows\System32\deviceenroller.exe /c /AutoEnrollMDM"
}
}
```
The detection query that finds devices still on the old MDM — replace INPUTURLHERE with your own MDM URL:
```sql
SELECT 1 FROM registry
WHERE path LIKE 'HKEYLOCALMACHINE\SOFTWARE\Microsoft\Enrollments\%%'
AND name = "DiscoveryServiceFullURL"
AND data NOT IN ("INPUTURLHERE")
```
Migrate Macs registered in Apple Business
For supervised Macs in Apple Business Manager:
- Connect to Apple Business Manager in Settings > MDM > Apple.
- Reassign the devices to the new MDM server in Apple Business Manager. This does not erase anything.
- Remove the old profile by unenrolling the devices in your previous console — Apple Business Manager does not do this for you.
- The employee accepts the new profile from the Remote Management prompt on the device.
Tips and Best Practices
- Do the Entra steps before you migrate anything. If automatic enrolment still points at Intune, devices bounce back to it and the migration looks broken for no visible reason.
- Test the detection query before linking the script to a policy. Get it wrong and you run a registry-editing script against machines that did not need it.
- Use the policy route for anything above a handful of devices. Migrating one at a time is fine for a pilot and unmanageable for a fleet.
- On Macs, tell employees the Remote Management prompt is coming. They have to accept it, and an unexpected prompt about remote management is exactly the kind people dismiss.
Troubleshooting and FAQ
Troubleshooting
- A Mac has the agent installed but is not managed. Expected: the enrolment profile still needs accepting. Nothing is wrong — for a touchless result you need zero touch.
- Windows devices migrate and then come back to the old MDM. Automatic enrolment in Entra still points at Intune. Set both Mobility options to None.
- The migration script runs but nothing happens. The URL in $DiscoveryServerFullUrls does not match the old MDM's discovery URL, so nothing matches and nothing is removed. Check the value on a real device first.
- Old device records remain in the previous console. They are not removed automatically. Delete them by hand once the migration is confirmed.
FAQ
-
Does this wipe devices?
No. Employees keep their data, apps and session.
-
Does it work on phones?
No — desktop platforms only. Use employee enrolment or account-driven enrolment for mobile.
-
Can we migrate from any MDM?
Yes for the general case. Intune needs the extra Entra steps above.