UEM and MDM migration
with ISEC7 SPHERE
Why every device has to move when you switch UEM
A phone can only be enrolled in one UEM environment at a time. When you change platforms, each device is unenrolled from the old environment and enrolled in the new one. In between there's a gap: according to Microsoft's migration guide to Intune (Microsoft Learn, updated June 2026), unenrolled devices don't receive your policies, including protection policies, until they enroll in the new environment.
Waves, not a cutover date
Source and target platforms run side by side for a while, and devices move group by group, starting with a first wave of IT staff and power users. Microsoft recommends the same: start with a pilot group, then add more groups.
Users pick the time
Each user starts the move of their own device in a window that fits their working day. Where you need to, you can also force the migration.
IT sees every status
Running, scheduled and completed migrations sit in one overview. If a device gets stuck, you see it and can resend the activation email.
How you run the migration with ISEC7 SPHERE
ISEC7 SPHERE connects to the source and target environments at the same time and drives the migration through migration profiles: you select users or user groups, assign them to waves and decide when and under which conditions the migration starts. Users carry it out themselves, in the user self-service portal or the migration app. The tool isn't a new UEM. It's the layer above that steers the switch between two UEM platforms.
Migration profiles and waves
For each migration you set the start time, a notification or activation email, the flow, conditions and the intervals between waves. One condition can be that the employee confirms before the migration starts.
Self-service for users
Users trigger the move themselves, usually at a time of their choosing. The self-service portal and the app guide them step by step, so IT doesn't have to handle every device.
Apps for iOS and Android
ISEC7 SPHERE Device Migration is available on the App Store and Google Play. Your UEM distributes the server address and credentials through app configuration; without it, no migration data flows. Logo, texts and additional languages are set the same way. When Microsoft Intune is the target, the app tells users to activate their profile in the Company Portal, opens the Company Portal and confirms when the migration has finished. The Company Portal has to be available on the device.
An overview for IT
A traffic-light view and dashboards show which migrations are running, scheduled or done. You can export reports as CSV and resend activation emails when needed. A stuck migration leaves a device that no longer meets any policy, and the overview lets you find it.
Which migrations ISEC7 SPHERE covers
Besides switching UEM platforms, the migration module handles three more cases: moving users between Active Directory domains, changing the mail platform and replacing devices. All four follow the same pattern of migration profile, source and target.
Switching between UEM platforms
Source and target both have to be connected to ISEC7 SPHERE, and the direction is up to you. You can connect BlackBerry UEM (on-premises and cloud), Ivanti EPMM, Ivanti Neurons for MDM, Omnissa Workspace ONE UEM and Microsoft Intune. Each connection needs a service account in that system and a firewall rule. Jamf is not connected at this time.
Domain migration
When users move to a new Active Directory domain, ISEC7 SPHERE migrates their accounts and devices along with them. For migrations across several domains, you create one service account per domain.
Mail migration
Changing the mail platform also runs on migration profiles, for example from on-premises Exchange to Microsoft 365. ISEC7 MAIL profiles can be migrated too.
Device replacement
When employees get a new phone, the move runs by profile through the portal or the app, so even large replacement waves don't need IT to touch each device. On Android, the app backs up SMS, call logs and local contacts and restores them, as long as the device runs in the UEM's COBO mode. In BYOD fleets this data migration doesn't apply.
A related case: Acronis Cyber Files receives no security updates after December 31, 2026, and Microsoft is phasing out NTLM. Both affect how phones sign in to your network and reach your file shares. How ISEC7 rolls out Hypergate as the replacement is covered on the Hypergate migration page.
How a migration project with ISEC7 works
ISEC7 runs migration projects in phases: test first, then build the production environment, then migrate in waves. How long it takes depends mainly on the number of devices and the size of the waves.
- Proof of concept: You test the migration module in the ISEC7 test environment, supported by ISEC7 consultants. ISEC7 always recommends this step.
- Production environment: ISEC7 builds the environment with you, preferably in your own infrastructure, or from the cloud if you prefer. It needs connections to Active Directory or Entra ID and to the UEM systems.
- Onboarding and test migration: Your team learns the migration module. The first migration configuration and a test migration are set up together.
- Migration in waves: Wave 0 with IT staff and power users, then the remaining groups.
- Hypercare: ISEC7 can accompany the migration phase and take over first-level service if you don't have the people for it. Second-level support is always available.
- Operations: If you'd rather not run the new environment yourself, you can hand it to ISEC7 as a managed service. More on this under Endpoint Management.
Further reading
In the webcast of October 14, 2025, ISEC7 experts walk through the process with a live demo, from the admin's and the user's point of view (in German): request the webcast recording. The blog post on UEM migration covers the background. You'll find every feature of the suite on the ISEC7 SPHERE page.
Frequently asked questions about UEM and MDM migration
How do I migrate phones from one UEM to another while people keep using them?
In waves: the source and target platforms run side by side for a while, and devices move group by group instead of all on one cutover date. ISEC7 steers this with the migration module of ISEC7 SPHERE, which is connected to both platforms at the same time. Users start the move of their own device in their own time window and according to a migration profile, in the self-service portal or in the migration app for iPhone and Android.
Does a device have to be re-enrolled when you switch MDM?
Usually, yes. A device can only be enrolled in one UEM environment at a time, so it's unenrolled from the old one and enrolled in the new one. Apple devices have their own route from iOS 26, iPadOS 26 and macOS 26: devices from Automated Device Enrollment can be migrated to another device management service through Apple Business, and managed apps and data can be kept (Apple Platform Deployment, 2026). Whether that route fits your fleet is something we'll look at with you.
Do SMS, call logs and contacts get lost when a phone is replaced?
Not on Android, if the device runs in the UEM's COBO mode: the ISEC7 SPHERE Device Migration app backs up SMS, call logs and local contacts and restores them on the target device. In BYOD fleets this data migration doesn't apply.
Can we move from Ivanti, Workspace ONE or BlackBerry UEM to Microsoft Intune?
Yes. ISEC7 SPHERE connects to Ivanti EPMM, Ivanti Neurons for MDM, Omnissa Workspace ONE UEM, BlackBerry UEM and Microsoft Intune, and the migration can run in either direction between two connected systems. Both the source and the target always have to be connected. When Intune is the target, the Company Portal has to be available on the devices; the migration app opens it and walks users through activating their profile.
How do I keep track of stuck devices during a migration?
The migration overview in ISEC7 SPHERE shows running, scheduled and completed migrations with a traffic-light view and dashboards. If a device gets stuck, you resend the activation email or contact the user directly. You can export the status of every wave as a CSV report.
Can I migrate users between Active Directory domains?
Yes. Cross-domain migration moves users and their devices from one domain to another, using the same migration profiles and self-service flow as a platform switch. For migrations across several domains, each domain needs its own service account.
Can I test the migration tool before the project starts?
Yes. ISEC7 recommends a proof of concept in the ISEC7 test environment before every migration project, supported by ISEC7 consultants. The migration app also has a demo mode that runs without any configuration.
Where does ISEC7 SPHERE run, and what does the installation need?
In your own data center on Windows Server 2016 to 2025 (64-bit) with SQL Server 2016 to 2022, or ISEC7 rolls the environment out from the cloud. It needs connections to Active Directory or Entra ID and to the UEM systems, each with a service account and a firewall rule. The Check Before Installation Guide is available on request.
Information as of October 8, 2026 · Microsoft Learn, Migration guide to Microsoft Intune · Apple, Migrate managed devices to another device management service
Plan your UEM migration with ISEC7
Switching UEM platforms, moving users to a new domain or preparing a device refresh? Tell us briefly where you're starting from: source and target system, rough device count, iOS or Android. We'll walk you through the process in a demo and discuss whether a proof of concept makes sense for you.