---
title: "ControlUp Migration for Windows 365 Prerequisites"
slug: "migration-windows-365-prerequisites"
updated: 2026-07-16T06:37:18Z
published: 2026-07-16T06:37:18Z
canonical: "support.controlup.com/migration-windows-365-prerequisites"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ControlUp Migration for Windows 365 Prerequisites

Based on the Microsoft migration API, our tool to migrate to Windows 365 automates the process from VM selection to provisioning a new cloud PC. IT teams can realize time savings and potentially lower their costs for the transition.

This article outlines the steps required to prepare your environment and configure Azure permissions for our **ControlUp Windows 365 Migration** tool. You must complete these prerequisites once per tenant to enable snapshot-based provisioning and Cloud PC creation via the Microsoft Graph API.

After you complete the prerequisites, you can move your organization’s Azure VMs to Windows 365 Cloud PCs. Get started [here](https://migrate.controlup.com/).

## System Requirements

- Azure Active Directory role: Global Administrator or Cloud Application Administrator.
- Microsoft Azure subscription containing the VMs or AVD Personal Desktops to migrate.
- Windows 365 Enterprise license for each target user.

## Step 1: Register App in Azure Portal

To register apps in Microsoft Azure Portal:

1. Open [Azure Portal](https://portal.azure.com/).
2. In the Search bar, enter “App registrations” and click **App registrations**.
3. Click **+ New registration**.

![app registrations page](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365AppRegi.png)
4. On the **Register an application** page, provide a name for the app.

![register an application page](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365RegApp.png)
5. **Important**: Store the following values for later use during the Windows 365 Migration setup:
  - **Application (client) ID**
  - **Directory (tenant) ID**

![values for migration setup showing display name, application ID, object ID, directory ID, and supported account types](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365Values.png)
6. In the app menu under Manage, go to **Certificates & secrets** and click **New client secret**.

![Certificates & secrets page with New client secret button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365NewClient.png)
7. Provide a description and click **Save**.

> [!WARNING]
> Important!
> 
> Copy the secret value once it's created. You **can’t** retrieve it later.

You should now have the following:

- **Application (client) ID**
- **Directory (tenant) ID**
- **Client Secret**

> [!WARNING]
> Important!
> 
> Keep the client secret secure by storing it in a password vault or Azure Key Vault. Never share or email it in plain text.

## Step 2: Grant Microsoft Graph API Permissions

1. In **App registrations**, click **API permissions** > **+ Add a permission**.

![App permissions page with configured permissions section showing add a permission button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365AppPerm.png)
2. Click **Microsoft Graph** > **Application permissions**.

![request api permissions page with Microsoft graph option](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365RequestAPIPermission.png)
3. Add the following permissions:
  - Directory.ReadWrite.All
  - CloudPC.ReadWrite.All
  - User.Read.All
4. Click **Add permissions**.
5. Confirm all permissions are listed under **Configured permissions** as “Application” type.

![api permissions page with configured permissions list](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365APIPermissiosCon.png)

## Step 3: Grant Admin Consent

1. In **Application permissions**, click **Grant admin consent for** [Your Organization].
2. Click **Yes**.

![Grant admin consent confirmation popup showing yes button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365APIPermission.png)
3. Status updates to ✅ **Granted for** [Tenant Name].

![configured permissions list showing permissions granted](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365APIPermissiosSucc.png)

> [!WARNING]
> Important!
> 
> The migration tool requires admin consent to access Microsoft Graph API. Without it, snapshot imports and Cloud PC provisioning fail.

## Step 4: Add IAM Permissions

1. Go to **Subscriptions** and click the subscription that you want to migrate from.
2. Copy the **Subscription ID**.

![Subscription ID is copied to clipboard](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365copyPerm.png)
3. Click **Access control (IAM)**.
4. Click **+ Add** > **Add role assignment**.
5. Add the “Reader” role to the service principal of the app you created in [Step 1](/v1/docs/migration-windows-365-prerequisites#step-1-register-app-in-azure-portal).

## Step 5: Verify Permissions

Verify the following:

1. Graph permissions list shows all three permissions above with status **Granted for** [Tenant Name].
2. Under **Enterprise applications**, **ControlUp Migration for Windows 365** app appears.

Note that the graph might take up to 10 minutes to apply new permissions (no restart needed).

## Step 6: Prepare Credentials for Migration Tool

When you log into ControlUp Migration for Windows 365, verify you have the following:

| Field | Description |
| --- | --- |
| Tenant ID | Azure Directory ID |
| Subscription ID | Azure subscription ID hosting the VMs |
| Client ID | Application (client) ID from the registration |
| Client Secret | Secret value created earlier |

After entering the above fields, click **Verify Permissions** to confirm access to Microsoft Graph and Azure Resource Manager.

## Final Validation Checklist

| Step | Validation |
| --- | --- |
| Register App | App appears under Azure **App registrations** |
| Grant Microsoft Graph API Permissions | Directory.ReadWrite.All, CloudPC.ReadWrite.All, User.Read.All |
| Grant Admin Consent | Status = ✅ **Granted for** [Tenant Name] |
| Verify Permissions | "Permissions Verified” message appears |
| W365 Enterprise licenses | Each target user licensed |

##