Migrating from Intune to Hexnode: A Zero-Downtime Technical Playbook

This migration hub provides administrators, IT teams, and solution partners with a structured framework for migrating endpoints, policies, identities, applications, and compliance workflows from Intune to Hexnode.

The guide is organized into five operational phases:

1. Assessment
2. Parallel Deployment
3. Migration Execution
4. Validation
5. Decommissioning

It also includes:

• Rollback planning
• Downtime expectations
• Risk analysis
• Common migration failure scenarios
• Best practices for enterprise-scale deployments

Prerequisites

Before starting migration:

• Administrative access to both Intune and Hexnode portals
• Global Administrator or equivalent permissions
• Device inventory export from Intune
• Identity provider documentation
• Existing compliance and conditional access policies
• Application deployment inventory
• Certificate inventory
• Enrollment method documentation
• Network and firewall requirements review

Migration Architecture Overview

Recommended Migration Model

For large-scale deployments, Hexnode recommends a phased coexistence model instead of a direct cutover.

Typical Migration Flow

1. Intune Environment
2. Assessment & Inventory
3. Parallel Hexnode Setup
4. Pilot Device Migration
5. Department-wise Rollout
6. Validation &; Monitoring
7. Intune Decommissioning

Phase 1 – Assessment

The assessment phase identifies all dependencies, policies, and enrollment models currently managed through Intune.

1.1 Export Device Inventory from Intune

Generate a complete inventory of:

• Windows devices
• macOS devices
• iPhones and iPads
• Android devices
• BYOD endpoints
• Shared and kiosk devices

Required Data Points

Recommended Actions

• Identify inactive devices
• Remove duplicate records
• Flag unsupported OS versions
• Separate pilot groups

1.2 Application Dependency Mapping

Create a catalog of all managed applications.

Assess:

• Required business applications
• Line-of-business apps
• Win32 applications
• Store apps
• VPP applications
• Managed Google Play apps
• Scripts and PowerShell deployments

Document:

1.3 Compliance Policy Audit

Review all compliance policies currently enforced through Intune.

Validate:

• Password policies
• Encryption requirements
• Root/jailbreak detection
• Antivirus requirements
• OS version requirements
• Device health attestation
• Firewall policies

Recommended Outcome: Create a policy equivalency matrix between Intune and Hexnode.

1.4 Conditional Access Review

Analyze identity and access dependencies.

Review:

• Conditional access rules
• MFA integrations
• Entra ID device trust requirements
• SSO dependencies
• Zero Trust workflows

Key Questions:

• Which applications require compliant devices?
• Which workflows rely on Intune compliance signals?
• Are there security baselines tied to Microsoft security services?

1.5 Enrollment Type Identification

Identify all active enrollment methods.

Common Enrollment Types

Why This Matters: Migration complexity varies significantly based on enrollment type.

Phase 2 – Parallel Deployment

This phase establishes Hexnode alongside Intune before device migration begins.

2.1 Co-management Strategies

During coexistence, some devices may temporarily remain managed by both platforms.

Best Practices:

• Avoid duplicate compliance enforcement
• Prevent policy conflicts
• Separate deployment scopes clearly

2.2 Hybrid Coexistence Planning

Define which services remain in Intune during transition.

2.3 Identity Federation

Configure identity integration.

Supported Identity Providers:

• Entra ID
• Okta
• Google Workspace
• Active Directory

Validation Checklist:

• SSO login works
• Group sync functions correctly
• User provisioning succeeds
• RBAC mapping is validated

2.4 Token and Certificate Planning

Review all certificate dependencies before migration.

Common Components:

• APNs certificates
• Android Enterprise tokens
• SCEP certificates
• PKI integrations
• VPN certificates

Phase 3 – Migration Execution

This phase handles actual endpoint movement from Intune to Hexnode.

Windows Migration

3.1 Windows Autopilot

1. Export Autopilot device records
2. Remove deployment profile assignments
3. Configure Windows enrollment in Hexnode
4. Re-register devices where required
5. Apply baseline policies

Considerations:

• Existing Autopilot registrations may require cleanup
• Hybrid Entra ID join environments need additional validation
• BitLocker recovery workflows should be tested first

Android Migration

3.2 Android Enterprise

• Fully managed devices
• Work profile
• Dedicated devices
• Corporate-owned work profile

Recommended Process:

• Remove Intune work profile
• Re-enroll through Hexnode
• Reassign managed Google Play apps
• Reapply restrictions and compliance

Apple Migration

3.3 Apple ADE

• Assign devices to Hexnode UEM server in Apple Business Manager
• Remove old MDM profiles
• Re-enroll devices
• Deploy configuration profiles
• Validate supervision status

Recommended Validation:

• ADE assignment status
• VPP app reassignment
• Supervision retention
• Activation lock handling

BYOD Migration

3.4 BYOD

BYOD migrations require special handling to minimize user disruption.

Recommended Approach:

• User communication campaign
• Self-service enrollment instructions
• Staggered migration windows
• Clear rollback instructions

User Experience Priorities:

• Preserve personal data
• Minimize app reauthentication
• Reduce downtime

3.5 Application Reassignment

Reassign applications after enrollment.

Validate:

• Licensing availability
• Silent deployment support
• VPN dependencies
• Managed app configurations
• Data protection policies

Phase 4 – Validation

Validation confirms operational readiness after migration.

4.1 Compliance Verification

Validate:

• Device encryption
• Passcode enforcement
• OS compliance
• Threat detection
• Device restrictions

4.2 Reporting Validation

Verify:

• Device inventory reporting
• Compliance reports
• Audit logs
• Application deployment status
• Security incident visibility

4.3 Security Posture Checks

Focus Areas:

• Conditional access continuity
• Certificate trust chains
• VPN functionality
• Email access restrictions
• Endpoint protection integration

4.4 User Experience Testing

Test Scenarios:

• First login experience
• App access
• VPN connectivity
• Wi-Fi onboarding
• Password resets
• Device compliance remediation

Phase 5 – Decommissioning

Once migration is validated, begin retiring Intune dependencies.

5.1 Retire Old Policies

Gradually disable:

• Device compliance policies
• Configuration profiles
• Legacy scripts
• App assignments

Best Practice: Disable in stages instead of deleting immediately.

5.2 Cleanup Certificates

Remove unused:

• APNs certificates
• SCEP integrations
• PKI connectors
• Enrollment tokens

5.3 Remove Legacy Profiles

Ensure devices no longer retain:

• Intune MDM profiles
• Legacy certificates
• Deprecated VPN profiles
• Obsolete Wi-Fi configurations

5.4 Archive Reporting

Before complete shutdown:

• Export audit logs
• Archive compliance reports
• Retain security history
• Preserve licensing documentation

Rollback Strategies

A rollback plan should exist before any production migration.

Rollback Best Practices:

• Retain Intune licenses during transition
• Keep compliance policies inactive instead of deleted
• Preserve deployment groups
• Document rollback ownership

Downtime Expectations

Common Downtime Scenarios:

• App reauthentication
• VPN reprovisioning
• Device restart requirements
• Compliance re-evaluation

Recommended Practice: Perform migrations during low-impact business hours.

Risk Matrix

Common Failure Scenarios

• Conditional Access Lockout:
  • Cause: Compliance dependencies still reference Intune.
  • Prevention: Validate all access policies before migration.
• Android Work Profile Removal Failure:
  • Cause: Residual management components remain active.
  • Prevention: Use standardized unenrollment procedures.
• Apple ADE Assignment Delays:
  • Cause: Apple Business sync latency.
  • Prevention: Allow synchronization time before enrollment.
• BitLocker Recovery Key Loss:
  • Cause: Encryption workflows not validated.
  • Prevention: Test recovery workflows before production rollout.
• Duplicate Configuration Policies:
  • Cause: Policies deployed simultaneously from both platforms.
  • Prevention: Clearly define coexistence boundaries.

Recommended Enterprise Migration Strategy

For environments managing 50k–100k devices:

• Begin with a pilot group
• Migrate department-wise
• Maintain coexistence temporarily
• Validate security posture continuously
• Delay Intune decommissioning until audit completion