# How to migrate Windows 10 or above Group Policies to MDM CSPs?

Last updated: July 24, 2026

This guide explains how to migrate legacy Group Policies on Windows 10+ devices to MDM Configuration Service Providers (CSPs) for bulk deployment. After installing Remote Server Administration Tools, admins run Microsoft's MMAT tool via PowerShell to generate an XML report of Group Policies with matching CSPs, then upload that XML into a Windows profile's Custom Configurations, review the generated OMA-URI settings and values, and publish the profile to devices and groups.

**Disclaimer:**

You can migrate group policies to CSP either manually or by using the MMAT tool. Microsoft has deprecated the use of the MMAT tool. Follow the [doc](https://www.manageengine.com/mobile-device-management/help/profile_management/windows/mdm_custom_configuration_profiles.html) to manually [migrate](https://learn.microsoft.com/en-us/windows/client-management/mdm/) Group Policies to MDM CSP's.

## Description

With modern management capabilities available for managing Windows 10 or above devices, most organizations prefer using MDM solutions for managing them. While organizations are transitioning to MDM solutions, they still have legacy Group Policies applied on these devices. Microsoft now provides organizations an option to migrate their Group Policies applied to Windows 10 or above devices as MDM Configuration Service Provider (CSP) which can then be deployed in bulk on devices using an MDM solution. This migration requires the MDM Migration Analysis Tool (MMAT) developed by Microsoft. This tool helps in generating an XML file with a list of all the Group policies and their corresponding MDM CSPs. This XML file only contains the Group policies which have a corresponding CSP available.

Follow the steps given below to generate the XML file and migrate Windows 10 or above Group Policies to MDM CSPs.

## Steps

- To run MMAT, first ensure Remote Server Administration Tools (RSAT) is installed on the device. If it's not installed, download it from [this link](https://www.microsoft.com/en-us/download/details.aspx?id=45520).
- After ensuring RSAT is available on the device, run MMAT by clicking on the **Clone or Download** button available in [this link](https://github.com/WindowsDeviceManagement/MMAT). Unzip the downloaded folder.
- Open PowerShell Window running as an Admin.
- Change the directory to the MMAT master folder which contains all the scripts and EXEs.
- Execute the following commands:

```powershell
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process
$VerbosePreference="Continue"
./Invoke-MdmMigrationAnalysisTool.ps1 -collectGPOReports -runAnalysisTool
```

(This command generates the XML file with the Group Policies available in the device where the command is executed.)

In case you wish to generate the XML file for your Domain server use the command:

```powershell
./Invoke-MdmMigrationAnalysisTool.ps1 -targetDomain <Domain name> -collectGPOReports -runAnalysisTool
```

- Running the above commands will generate an XML file titled **MDMMigrationAnalysis.xml** and an HTML file titled **MDMMigrationAnalysis.html** in the MMAT folder. The XML file will be required to complete the migration on the MDM console while the HTML file can be used to obtain details about Group Policies that don't have a corresponding CSP and hence cannot be migrated.
- On the MDM server, navigate to **Device Mgmt -> Profiles** and create a **Windows profile**.
- Select **Custom Configurations** policies and click on the **Migrate from GPO to MDM** button.
- Upload the XML file that was generated by MMAT and click on **Load GPO**.
- This will add all the Group Policies as configurations and link to the respective CSP documentation. These CSP documents contain details about the supported actions, data type and values which needs to be entered.
- You can select the configurations that you want to configure and delete the ones that are not required. Verify all the OMA-URI, Actions, Data type and Value before saving the profile. Publish the profile for distribution.
- Test the profile by [distributing it to a device](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) and upon successfully testing the profile, [distribute it to the required Groups](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_groups.html).

## Frequently asked questions

### Why do I need the MMAT tool to migrate Group Policies to MDM CSPs?

The MDM Migration Analysis Tool (MMAT) generates an XML report listing only the Group Policies that have a corresponding MDM CSP, so you know exactly what can be migrated before uploading it to your Windows profile.

### What do I need installed before running MMAT?

Remote Server Administration Tools (RSAT) must be installed on the device before you run MMAT from an admin PowerShell window.

### What happens to Group Policies that don't have a matching CSP?

They're listed in the generated MDMMigrationAnalysis.html file and can't be migrated to an MDM CSP.