How to migrate using UEM Migration tool

Last Updated On: 16 Jul 2026|

21 minutes read |

Prerequisites

Configure the APNS certificate and Knox enrollment on the destination server.
Create the credentials in Credential Manager on the destination server exactly as they exist on the source server, ensuring there are no case sensitivity errors, spaces, or extra characters (only if credentials are used in configuration).
If you are migrating an On-Premises product, verify that the NAT used on the source/destination server matches the domains listed in the SSL certificate of the source server.
Ensure both the source and destination servers are reachable from the machine where the migration tool is installed, with a reliable network connection.
Ensure both the source and destination licenses are active and that the license is not downgraded.
Ensure the email ID is configured for the local admin user in MDM Users on the source server.
Check that the source server is updated to the latest version. If not, upgrade to the latest build before migration (check latest build here).
Ensure destination server prerequisites are met before proceeding with data migration.

Important

Please make sure the following network settings are in place before starting the migration. These are required to transfer and sync data successfully.

Outbound

Source Server (MSP Server): Allow the required domain and port to connect with the machine where the migration tool is installed. Only outbound connections are needed. (If the source server and migration tool are on the same network, this step is not needed.)
If you are migrating from, or to, a Cloud product, allow access to *.manageengine.com and *.zoho.com for outbound connections. The domain may vary based on your cloud setup. All connections use port 443.
If you need specific domains to be whitelisted, allow the following:
- https://patchdb.manageengine.com
- https://mdm.manageengine.com
- https://mdmdatabase.manageengine.com
- https://www.zoho.com
- https://manageengine.com
- https://creator.zoho.com
Based on International Data Center:
- https://mdm.manageengine.in/com/uk
- https://endpointcentral.manageengine.in/com/uk
- https://download-accl.zoho.com/in/uk
- https://downloads.zohocdn.com/in/uk
- https://accounts.zoho.com/in/uk
- https://upload-accl.zoho.com/in/uk
- https://uploads.zohocdn.com/in/uk

Inbound (iOS Devices)

If you are migrating iOS devices, you can do it in either of these ways:

Using ME MDM App
Using Webclip: If you prefer this option, make sure port 7383 is allowed for inbound connections. (Optional)

Agent details that are migrated using the UEM migration tool

Category	Migrated details
Scope of Management	Agents meta in SOM view Custom groups Remote office (Distribution server needs to be installed manually) Domains without credentials Replication Policy details
Software packages	Manually-created software packages Template package (only live & unmodified packages are migrated) Auto-Update template Auto-Update policies
Patch	Settings: Patch DB Settings Cleanup settings Download settings System Health Policy Office Click To Run Script Repository Test Group Decline Patch Deployment Policy Automate patch deployment
Configurations	All configurations and configuration templates will be migrated, except the following: Mac configurations Configurations linked to non-live or modified template packages Configurations with file uploads larger than 250 MB Note: The following settings will also be migrated: Configuration settings USB settings Windows: All configurations except Secure USB, User Management, and WiFi will be migrated. Mac: Custom script, Message box, File folder operation, Install/uninstall software, Install/uninstall patch — only these configurations will be migrated. Linux: Custom script, Message box, Install/uninstall patch — only these configurations will be migrated. Certain configurations (e.g., file folder operations, folder backup) may require credentials to execute successfully. These configurations need to be redeployed to the targets with the necessary credentials.
Mobile Device Management	Apps: Store apps AFW account Profiles Groups Users Devices Managed Google Play
Vulnerability Manager	Software Vulnerability Exception System Misconfiguration Exception RDS Software Exception Peer To Peer Software Exception Web Server Misconfiguration Exception Policy Group Compliance Audit Quarantine Policy
Bitlocker	BLM Policy BLM Policy Management
Device Control	DCP Settings DCP Trusted Device DCP Policy DCP Policy Deployment

Note

Data in features other than the ones mentioned above must be created manually.
Active Directory-based Custom Groups, default Custom Groups, and AD users (along with their associated groups and tasks) will not be migrated.
Script files larger than 250 MB will not be migrated.

To perform the migration

Download the UEM Migration Tool on the machine running the central server.
Install the downloaded EXE file and set up credentials to access the migration tool. Once you sign in, you will be able to view the migration tool console.
Configure Proxy Settings. Supported options:
1. No Connection to Internet
2. Direct Connection to Internet
3. HTTP Proxy configuration
4. Automatic configuration using script
To set up proxy settings, click Settings → Proxy → Choose the connection type from the dropdown → Save.
For Apple devices, configure NAT settings by clicking Settings → NAT and adding the required IP address or FQDN, then click Save.
Navigate to the Migration tab and click Migrate Now to proceed.

Steps to authenticate for On-Premises product

Note

This authentication step is explained for migrating from Endpoint Central On-Premises to Endpoint Central Cloud. You can choose the appropriate authentication depending on the on-premises product you are migrating. If you are migrating from a Cloud product, refer to Steps to authenticate for Cloud product.

Select the required product for migration (the product whose data needs to be migrated). For example, select Endpoint Central On-Premises as the product name and provide the source server authentication details.
Since the source server is an on-premises product, you will need to enter the API key.
Note
If the source server or destination server is an on-premises product, an API key will be required.

To generate the API key, follow the steps below:

Navigate to Admin > Integrations > API Key Management.
Select the Generate Key option.
Choose the option Custom Integration.
Enter any service name and enable all permissions for all modules.
Ensure all checkboxes are enabled for all modules.
Click Generate Key. The API key will be generated with all permissions.
Enter the Server URL in FQDN format in the Server URL field and click Proceed. You will be navigated to the destination server page.

Steps to authenticate for Cloud product

Note

This authentication step is explained for migrating from Endpoint Central Cloud to Endpoint Central On-Premises. You can choose the appropriate authentication depending on the cloud product you are migrating. If you are migrating from an On-Premises product, refer to Steps to authenticate for On-Premises product.

Select the required product to be migrated (the product where data needs to be migrated). For example, select Endpoint Central Cloud as the product name and provide all the destination server authentication details. Click Authenticate.
You will be navigated to the cloud accounts page to sign in. After logging in with your destination cloud server account, you will be redirected to the Consents page. Click Accept after reading all the terms and agreements.
After authentication is complete, you will be navigated to the confirmation page. Click Migrate Now.
A pop-up will appear confirming the source and destination server details. Click Accept and Migrate.

How to migrate between UEMS Cloud products?

Select the source server name as the product name.
Select the Data Center in which your account is present.
Click Authenticate. You will be redirected to the accounts page to log in.
Click Accept on the Consents page.
After authentication is complete, you will be navigated to the destination server authentication page. Choose the Cloud product as the product name and provide all the destination server authentication details.
You will be redirected to your cloud account's sign-in page. Enter the email and password associated with your cloud account, then click Accept on the Consents page. Confirm that the email shown on the destination server page is accurate. If not, click Reauthenticate.
After signing in, you will be navigated to the confirmation page. Click Migrate Now.
A pop-up will appear confirming the source and destination server details. Click Accept and Migrate.

Module customisation

After completing authentication, proceed to the next step to customise the modules for migration. Choose the data modules to migrate.

Each module represents a category such as:

Users
Groups
Devices
Apps
Profiles
Enrollment Tokens

Select the required modules, keeping in mind any dependencies. For example, the Groups module depends on the Users module — if the Users module is not selected, Groups cannot be migrated.

Select the checkbox to view the list of prerequisites in a pop-up. Ensure all prerequisites are completed before proceeding. Click Agree and Proceed to continue.

Migrate the data

Now that you've selected the necessary modules, initiate the actual data migration.

Click Migrate Now to begin the data migration.
Monitor the status on the Migration Status page.

Note

If a module migration fails, click Retry. If it still fails, report the issue to support.
If a dependent module fails, it will be marked as Skipped. While migration is in progress, you cannot retry, edit server details, or delete the configuration.
After the initial selection, you can use the Add New button to migrate additional features or modules that were not selected earlier.

Retry option for migration failure

All modules will be migrated from the source to the destination account. If any module encounters an unsuccessful migration, select that module and click Retry.

Device migration

Once all modules have been successfully migrated, follow the steps below to migrate your agents to the cloud server.

Migrate Windows/Mac/Linux devices

To migrate these agents, refer to Agent Migration from On-Premises to Cloud.

Migrate Android devices

Android devices must be migrated with a migration profile applied to the device, or re-enrolled post-migration.

Migrate iOS devices

How to migrate the MDM part of Windows endpoints from Endpoint Central On-Premises to Endpoint Central Cloud

This step is required only after deploying the Endpoint Central agent through the source UEM and confirming the connection is established between the Endpoint Central server and agents.

Refer to the agent installation document to install agents on Windows endpoints.

If you want to re-enroll devices under MDM, use Endpoint Central configurations by changing %EXE_PATH% to %EXE_PATH% -f in the enrollment.bat file inside scripts, and configure the Domain Controller configurations as mentioned in the document.

Important

Do not use this method for machines enrolled using Azure AD enrollment, as it will brick the device.

How to migrate the MDM part of Mac endpoints from Endpoint Central On-Premises to Endpoint Central Cloud

This guide covers the migration process for both ABM-enrolled and non-ABM Mac devices, including those managed by third-party vendors like JAMF, for the On-Premises to Cloud migration.

On the Endpoint Central Cloud console, navigate to Agent → SoM Settings.
Under the Enable MDM Profile tab, disable Mac Devices and click Save.
Install the agent from Endpoint Central Cloud on the target Mac devices.
After installation, create a custom script configuration using the provided script and dependency file.
Use the following arguments for the script file:
- EC OP Auth Key: Obtain the API key from the API Explorer.
- DC Cloud URL: Example — endpointcentral.manageengine.com
- DC OP URL: Example — https://fqdn:8383/
- Whether device is enrolled in ABM: Yes or No
Deploy the script from the Endpoint Central Cloud console.
The device will prompt for new profile installation. The end user must click Prompt and enter their password to enroll the device.

Note

For ABM-enrolled Mac devices running macOS Sonoma, use me-mac-migration.sh without the dependency file. The admin must run the script locally and enter admin credentials.
Remote migration is not supported for Sonoma devices due to macOS limitations.
Non-ABM devices will migrate without any issues, regardless of the macOS version.

Post-migration actions

Manually move the agent devices after successful migration. By default, new agents will be located under the default remote office. They can then be relocated under the respective remote offices — Remote office management.
Tasks created for deploying configurations and automated patch deployment will be saved as drafts and will remain suspended. They can be manually deployed to the targets after moving the agents to the respective remote office.
Domain metadata will be added; domain credentials can be entered to sync the domains.
Distribution servers for remote offices need to be manually installed.
Inventory scan details will be populated after agent migration.
Only software packages that are manually created, and template packages that are live and unmodified, will be migrated.
After migration, mobile devices will be moved to the respective group. Individual profiles that are device-specific will not be migrated and need to be manually redeployed.
Only AFW and enterprise apps will be migrated. Apple ABM/ASM tokens need to be manually added in the Cloud server.

Reach out to us for personalized migration assistance and dedicated support.