Short answer
There is no native Intune feature to move a device between tenants. Windows devices are usually reset and re-provisioned with Windows Autopilot in the target tenant, after the Autopilot registration is removed from the source. Some third-party tools re-join devices and keep user profiles without a wipe. iOS and Android devices are retired from the source and re-enrolled in the target.
Key facts
- Intune has no built-in cross-tenant device move; each device leaves one tenant and joins another.
- An Autopilot device must be deregistered from the source tenant before it can be registered in the target.
- Apple Automated Device Enrollment devices must be reassigned in Apple Business Manager to the target MDM server.
- Reset and Autopilot is the cleanest Windows path; profile migration tools avoid a wipe but add complexity.
- Target Intune policies, apps and compliance rules should be built and tested before devices move.
Why devices cannot simply be moved
A Windows device that is Microsoft Entra joined belongs to one tenant. Its join, its Intune enrollment, its Autopilot registration and its user profile are all tied to that tenant. To manage it in a new tenant, the device must leave the old one and join the new one.
The same applies to iOS, iPadOS and Android devices: their management profile belongs to the source Intune tenant. Moving them means retiring the old enrollment and enrolling again, which also re-applies apps and policies from the target.
Options for Windows devices
Pick the approach per device group. Laptops due for refresh, shared kiosks and heavily customized engineering machines can each take different paths.
| Approach | How it works | Best for |
|---|---|---|
| Reset and Autopilot | Remove device from source Autopilot and Intune, import hardware hash into target, reset device, user signs in to target | Most fleets; clean, supportable end state |
| New device on refresh | Ship new hardware registered to target Autopilot; retire old device | Devices near end of life |
| Profile migration tool | Third-party agent leaves source, joins target and remaps the user profile without a wipe | Users with complex local setups or limited downtime |
| Manual rejoin | Disconnect from source, join target, copy profile data by hand | Small numbers of devices only |
Running a reset and Autopilot move
This is the most common path and gives a known-good device in the target tenant. Order matters, because the hardware hash can only be registered to one tenant.
- Build target Intune configuration first: Autopilot or Autopilot device preparation profiles, compliance policies, configuration profiles, app deployments and update rings.
- Confirm user data is in OneDrive in the target tenant, or that Known Folder Move will restore it after sign-in.
- Export hardware hashes from the source, or capture them on the device, before deleting anything.
- Delete the device from source Intune, then deregister it from source Autopilot and remove the Entra ID device object.
- Import the hash into target Autopilot and assign a profile and group tag.
- Reset the device and have the user sign in with the target account to complete provisioning.
Mobile devices and Macs
Personally owned phones are retired from the source, which removes corporate apps and data, and the user enrolls again in the target or uses app protection policies without enrollment.
Corporate devices enrolled through Apple Automated Device Enrollment must be unassigned from the source MDM server in Apple Business Manager and assigned to the target's server, then wiped and re-enrolled. If the acquired company uses its own Apple Business Manager organization, devices need to be released and added to the target's organization, which can take coordination with the reseller. Android Enterprise corporate devices follow a similar pattern with zero-touch or QR re-enrollment.
Planning the device workstream
Device moves are usually tied to user waves, so a user changes tenant, account and device on the same day. For distributed sites, schedule by location and ship guidance or replacement hardware ahead.
Keep source compliance enforcement relaxed for devices not yet moved, and keep target Conditional Access device compliance in report-only mode until most devices are enrolled. Otherwise users may be blocked from mail while waiting for their device slot.
- Inventory devices by OS, ownership, join type and management state during discovery.
- Identify apps installed locally that are not deployed by Intune and need packaging.
- Check BitLocker recovery keys are escrowed before reset.
- Pilot with IT and a few users from each site.
How Accred Consulting approaches it
Accred Consulting plans device moves alongside user and mailbox waves so people change tenant once. We inventory every device, build and test target Intune and Autopilot configuration, and choose reset, refresh or profile migration per device group. Our US-based specialists run the pilot and coordinate site schedules directly with your team. In one engagement we moved about 280 devices across 11 locations to Autopilot and Intune. The proposal sets scope, a fixed price and a timeline, and handover includes build documentation.
Track record: 400+ client projects, 2,000+ migration workstreams and 150,000+ users migrated by a US-based team. Company facts · Case studies
Related questions
Want this scoped for your environment?
Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.
Book a free consultation