Movewise

Free, open-source Microsoft 365 tenant-to-tenant migration tool for policies: move Conditional Access, Intune, Defender, Exchange, Purview and Teams policies to another tenant, with a dry run before anything changes.

Website · Screenshots · Download · How it works · What it migrates · FAQ · Build from source · Docs

---

Movewise is a free Windows app for Microsoft 365 tenant-to-tenant migrations, for mergers, acquisitions, divestitures and MSPs consolidating tenants. It migrates policies and settings, not mailboxes or files: Entra ID Conditional Access, Intune, Defender for Office 365, Defender for Endpoint, Exchange Online, Purview, Teams and SharePoint.

An admin signs in to the source tenant (read only) and the destination tenant, picks the policies to move, maps every group, user, app and named location they depend on, checks the result in a dry run, and deploys. Every run can be resumed, and rolled back to take out only what it created. After the migration, Movewise compares tenants, takes snapshots, monitors configuration drift, and saves policy baselines to apply to other tenants.

Screenshots

All screenshots use the built-in demo tenants (Contoso and Fabrikam), so no real tenant data is shown.

How it works

flowchart LR
    A["Connect<br/>source + destination"] --> B["Discover<br/>read the source's policies"]
    B --> C["Map<br/>groups, users, apps, domains"]
    C --> D["Pre-flight<br/>dry run against the destination"]
    D --> E["Deploy<br/>in dependency order"]
    E -. if needed .-> F["Roll back<br/>only what the run created"]

Step	What happens
Connect	Sign in to each tenant through the Windows sign-in broker. Guest accounts and same-tenant pairs are refused, and each side's admin roles and licenses are checked. Tick the services to migrate: only those are read
Discover	Policies are read from the source with everything they point at: groups, users, apps, locations, filters, scope tags, domains, mailboxes and sites
Map	Each dependency is matched in the destination automatically where possible (by name, email, app ID or domain), or matched, created or removed by hand. Mappings export to and import from CSV
Pre-flight	Every policy is rewritten for the destination and checked: unmatched objects, name conflicts, missing licenses and roles, removed exclusions, and a before/after view per policy
Deploy	Groups and policies are created in order, with progress saved after every object. A run survives a crash, a stop or a dropped connection

Compare, snapshots, baselines and drift

Besides Migrations, the sidebar has four screens. All of them only read, except a restore you start yourself.

Screen	What it does
Compare	Source with destination shows which policies and settings are only in one tenant, and which are set differently. The source's policies are first put in the destination's terms (groups, users, locations matched as for a migration), so a group with a different ID isn't a difference. A tenant with a snapshot shows what was added, removed or changed since the snapshot. Each item shows both versions side by side, with only the settings that differ, and the comparison exports to CSV. Also opens from the Deploy screen once a run has finished
Snapshots	Take a point-in-time copy of either tenant, list them by tenant, and compare one with its tenant as it is now. Kept in %LOCALAPPDATA%\MovewiseData\Snapshots until you delete them
Baselines	Policies saved from a migration (Save as baseline on Discover), to apply to other tenants later without signing in to the template tenant again: on Connect, a baseline can be the source once the destination is signed in. Each baseline lists its policies
Drift monitor	Check now compares each signed-in tenant with its latest snapshot and lists what changed since, with the settings that differ. Open any item in Compare to see both versions or restore it

Restore from a snapshot. After comparing a tenant with a snapshot, Restore… recreates what was removed since and puts changed settings and policies back as they were. It runs the same pre-flight checks as a migration, then opens on the Deploy screen as a run you start, and can roll back. Restored policies come back in report-only or test mode unless you choose to recreate them as they were. A policy changed since, even renamed, is updated back in place. A restore never deletes anything added since. A snapshot can only be restored into the tenant it was taken of, signed in as the destination: the source is never changed.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗