ControlUp Migration for Windows 365 Prerequisites

Based on the Microsoft migration API, our tool to migrate to Windows 365 automates the process from VM selection to provisioning a new cloud PC. IT teams can realize time savings and potentially lower their costs for the transition.

This article outlines the steps required to prepare your environment and configure Azure permissions for our ControlUp Windows 365 Migration tool. You must complete these prerequisites once per tenant to enable snapshot-based provisioning and Cloud PC creation via the Microsoft Graph API.

After you complete the prerequisites, you can move your organization’s Azure VMs to Windows 365 Cloud PCs. Get started here.

System Requirements

• Azure Active Directory role: Global Administrator or Cloud Application Administrator.

• Microsoft Azure subscription containing the VMs or AVD Personal Desktops to migrate.

• Windows 365 Enterprise license for each target user.

Step 1: Register App in Azure Portal

To register apps in Microsoft Azure Portal:

1. Open Azure Portal.

2. In the Search bar, enter “App registrations” and click App registrations.

3. Click + New registration.

   

4. On the Register an application page, provide a name for the app.

   

5. Important: Store the following values for later use during the Windows 365 Migration setup:

   • Application (client) ID

   • Directory (tenant) ID

     

6. In the app menu under Manage, go to Certificates & secrets and click New client secret.

   

7. Provide a description and click Save.

   Important!

   Copy the secret value once it's created. You can’t retrieve it later.

   You should now have the following:

• Application (client) ID

• Directory (tenant) ID

• Client Secret

Important!

Keep the client secret secure by storing it in a password vault or Azure Key Vault. Never share or email it in plain text.

Step 2: Grant Microsoft Graph API Permissions

1. In App registrations, click API permissions > + Add a permission.

   

2. Click Microsoft Graph > Application permissions.

   

3. Add the following permissions:

   • Directory.ReadWrite.All

   • CloudPC.ReadWrite.All

   • User.Read.All

4. Click Add permissions.

5. Confirm all permissions are listed under Configured permissions as “Application” type.

   

Step 3: Grant Admin Consent

1. In Application permissions, click Grant admin consent for [Your Organization].

2. Click Yes.

   

3. Status updates to ✅ Granted for [Tenant Name].

   

Important!

The migration tool requires admin consent to access Microsoft Graph API. Without it, snapshot imports and Cloud PC provisioning fail.

Step 4: Add IAM Permissions

1. Go to Subscriptions and click the subscription that you want to migrate from.

2. Copy the Subscription ID.

   

3. Click Access control (IAM).

4. Click + Add > Add role assignment.

5. Add the “Reader” role to the service principal of the app you created in Step 1.

Step 5: Verify Permissions

Verify the following:

1. Graph permissions list shows all three permissions above with status Granted for [Tenant Name].

2. Under Enterprise applications, ControlUp Migration for Windows 365 app appears.

Note that the graph might take up to 10 minutes to apply new permissions (no restart needed).

Step 6: Prepare Credentials for Migration Tool

When you log into ControlUp Migration for Windows 365, verify you have the following:

After entering the above fields, click Verify Permissions to confirm access to Microsoft Graph and Azure Resource Manager.

Final Validation Checklist