'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Migrate Microsoft Defender for Endpoint from One Tenant to Another
Question details
The user needs to offboard devices from Microsoft Defender for Endpoint in an old tenant and onboard them to a new tenant in bulk using Intune, specifically for devices not joined to Microsoft Entra.
- Product
- Microsoft Defender for Endpoint
- Device & OS
- not provided
- Scenario
- Migrating device management and endpoint security from one Microsoft tenant to another via bulk operations.
- Observed behavior
- Devices must be cleanly disconnected from the original tenant and successfully registered to the new tenant's security portal.
Before beginning the migration, ensure you have Global Administrator or Security Administrator permissions in both the source and target Microsoft Defender portals, and verify that the devices are actively communicating with Intune.
Offboard and Onboard Devices Using Local Scripts via Intune
This method involves generating an offboarding script from your current tenant and an onboarding script from your new tenant, then using Intune to deploy these scripts in bulk.
Because the devices are not Microsoft Entra joined, utilizing Intune's bulk device actions or deploying local scripts via endpoint management policies is the most effective way to transition the endpoints without manual intervention on every machine.
In the Microsoft Defender portal of the old tenant, navigate to Settings > Endpoints > Device management > Offboarding. Select the operating system and choose 'Local script' as the deployment method, then download the package.
Use Intune Bulk Device Actions or endpoint management policies to deploy the downloaded offboarding script to the targeted devices. Allow time for the devices to process the disconnection.
Log into the Microsoft Defender portal for the new tenant. Go to Settings > Endpoints > Device management > Onboarding. Select the operating system, choose your deployment method, and download the new onboarding package.
Using Intune, create a new policy or use bulk actions to push the new onboarding package to the same group of devices. Monitor the deployment status within the Intune dashboard.
In the new tenant's Defender portal, check the Device Inventory list to confirm that the migrated devices are appearing with an 'Active' status.
Manage Your IT Migration Documentation with WPS Office
While WPS Office does not manage Microsoft Defender tenants, it is an excellent, lightweight alternative to Microsoft Office for creating, tracking, and sharing your IT migration checklists and deployment plans.
- 1. Download and install: Get WPS Office for free from the official website and install it on your admin workstation.
- 2. Create a migration tracker: Open WPS Spreadsheet to build a comprehensive list of devices, tracking their offboarding and onboarding status.
- 3. Save and share: Save your tracker in .xlsx format to ensure full compatibility when sharing with other IT team members.
Frequently Asked Questions
Can I migrate Defender devices without offboarding them from the old tenant first?
No. Devices must be completely offboarded from their current tenant before they can successfully connect to and be managed by a new tenant.
Do devices need to be Microsoft Entra joined for Intune bulk migration to work?
While Microsoft Entra join simplifies device management and identity, it is not strictly required. As long as the devices are enrolled in Intune or a supported MDM, you can deploy local offboarding and onboarding scripts.
How long does it take for a newly onboarded device to appear in the new tenant?
Once the onboarding script runs successfully, it typically takes a few minutes to an hour for the device to show up in the Device Inventory of the new Microsoft Defender portal.
What happens to the security alerts in the old tenant after migration?
Historical alerts and incidents remain in the old tenant based on your data retention policy, but the old tenant will stop receiving new telemetry and alerts the moment the devices are offboarded.
