- Platforms
- iOSAndroidmacOSWindows
- Products
- IntuneEntra IDEBF OnboarderWorkspace ONE
- Result
- An iPhone moves from Workspace ONE UEM to Intune without a reset, started by the user
Overview
Move iPhones and other devices from Workspace ONE UEM to Microsoft Intune with EBF Onboarder: users start the migration themselves, and you follow it on a dashboard.
EBF Onboarder is a cloud tool from EBF that automates migrations between mobile device management (MDM/UEM) systems. EBF Onboarder for Microsoft Intune moves iOS, macOS, Android and Windows devices to Intune from Omnissa Workspace ONE (formerly VMware Workspace ONE), Ivanti EPMM (formerly MobileIron), BlackBerry UEM, Jamf, MaaS360, Citrix XenMobile, SOTI and other systems.
The main benefit is the user experience. Users get an email and a push notification, and they start the migration themselves with a Start Migration button when it suits them. The administrator plans the migration in waves, sends reminders to users who haven't migrated yet, and follows the status on a dashboard.
EBF recommends waves of about 500 devices, no more than 1,000 devices per project and no more than 4,000 migrations started per day, because of Microsoft Graph limits. Licences are per migrated device, and the trial includes 20 free migrations. Microsoft recorded a video about the tool in 2018: EBF Onboarder for Microsoft Intune, Endpoint Zone 1807.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 for each user, and EBF Onboarder licences for each migrated device (20 free for a trial) | LicensingEBF Onboarder |
| Admin role | Application Administrator to register the app, and Privileged Role Administrator or Global Administrator to grant admin consent | Admin consent |
| Intune | Intune set up for enrollment: MDM authority, Apple MDM push certificate, enrollment restrictions that allow the devices | Push certificateApple enrollment |
| Entra ID | Your own app registration with Microsoft Graph application permissions and a client secret | EBF: Intune |
| Vendor | An EBF Onboarder for Microsoft Intune account | RegistrationProject setup |
| Workspace ONE UEM: a new API key and an admin account with the EBF role, without two-factor authentication | EBF: Workspace ONE | |
| Devices | Devices enrolled and active in Workspace ONE UEM. My test device was one iPhone 11 Pro with iOS 15. |
Configuration
Prepare access to Intune and Workspace ONE UEM first, then set up the migration in EBF Onboarder.
Register an app in Microsoft Entra ID
EBF Onboarder needs a service account to access Intune. EBF no longer supports its shared app, so you register your own app in Microsoft Entra ID (see EBF: Target system Microsoft Intune and Register an application). In the Microsoft Entra admin center go to Entra ID > App registrations > New registration and choose Single tenant:
On the app's Overview page copy the Application (client) ID and the Directory (tenant) ID:
Under Certificates & secrets create a client secret and copy its value. EBF suggests an expiry a few months after the planned end of the migration:
Under API permissions add Microsoft Graph > Application permissions:
In 2021 I added 12 permissions. EBF now lists a smaller set:
User.Read.All
Directory.Read.All
Device.Read.All
DeviceManagementManagedDevices.Read.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All (corporate devices only)
Group.ReadWrite.All (only to add migrated users to a group)
Then select Grant admin consent. Microsoft Graph application permissions need a Privileged Role Administrator or Global Administrator (see Grant tenant-wide admin consent).
Create an API key in Workspace ONE UEM
EBF Onboarder needs an API key and an admin account to read and retire devices in Workspace ONE UEM (see EBF: Source system Omnissa Workspace ONE). In the Workspace ONE UEM console go to Groups & Settings > All Settings > System > Advanced > API > REST API, set Enable API Access for the top organization group, and add a new key with the Admin account type:
EBF recommends a new key just for the migration (each key has a limit of 50,000 calls a day) and a dedicated admin account with an EBF role. Two-factor authentication must be turned off for that admin account.
Set up the migration in EBF Onboarder
After a short registration, I signed in to the EBF Onboarder for Microsoft Intune portal and selected New Migration:
The wizard has five steps: Name, Source, Target, Devices and Save (see EBF: Migration project setup):
For the source (Workspace ONE UEM) enter the host name, the API key, and the admin account:
For the target (Microsoft Intune) enter the tenant ID, client ID and client secret from step 1:
Then find the devices in the selected organization group (or all devices). You can also use a block list or allow list, or upload a CSV file:
EBF Onboarder lists the devices from Workspace ONE UEM. Optionally, migrated users are added to a Microsoft Entra group (here PILOT USERS):
Save the migration and send the invitation by email and push notification:
The migration status page shows the migrated device (see the user experience below):
You can add more migrations for other groups of users, device platforms or source systems:
User Experience
The user starts the migration from the invitation and enrolls in Intune.
My iPhone 11 Pro was enrolled in Workspace ONE UEM without Automated Device Enrollment (ADE). ADE devices can be migrated too: according to EBF they stay supervised without a reset, but the ADE server in Apple Business (formerly Apple Business Manager) must point to Intune first. Microsoft also points to the device migration that Apple added in iOS/iPadOS 26 (see ADE overview).
The user gets a message from EBF Onboarder in the Intelligent Hub app:
The user opens the email and, when ready, taps Start Migration:
During a 30-second countdown the device is unenrolled from Workspace ONE UEM, and the user gets a link to the Intune Company Portal in the App Store:
From here it's the standard Intune enrollment (see Enroll Apple mobile devices). The user installs Company Portal and signs in with the Microsoft Entra ID account:
The user downloads and installs the management profile in Settings, so the device trusts Intune:
Back in Company Portal, the user checks the device status and gets access to company apps and resources:
