Entra Profile Migration

Move someone's Windows profile from a local account to their Microsoft Entra ID account without rebuilding the PC. They sign in with their work account and find the same desktop, files, apps and settings.

First published 14 November 2026. Updated with every release.

What it does

Windows ties a profile to the account that created it. When a PC moves from a local account to Entra ID, the usual answer is a fresh profile and an afternoon of copying files and re-creating settings. This tool re-points the existing profile at the user's Entra account instead. Nothing is copied: the profile folder stays where it is.

• Backs up the profile's registry entry, folder permissions, encryption keys and saved Windows credentials before changing anything, and checks the backup.
• Gives the Entra account the same access to the profile folder and its registry hives that the local account had.
• Re-points the profile only once that has fully succeeded, then waits for the user's first Entra sign-in and confirms Windows used the migrated profile.
• Rolls everything back from the backup if needed. The original profile is never deleted.

What carries over and what doesn't

What it supports

Local accounts on Windows 10 or 11 Pro, Enterprise or Education, run as an administrator or as SYSTEM (for example from an RMM tool). It refuses to run, before changing anything, on:

• Windows Home. Upgrade to Pro first.
• Domain-joined or hybrid PCs, and Active Directory accounts. Not supported in this version.
• A user who is still signed in.

This is a release candidate. It has been tested end to end on Windows 11 in a lab virtual machine. Windows 10 and a real RMM rollout have not been tested yet.

Install

The installer and its scripts are signed with my own code-signing certificate, not one from a public authority, so each PC needs to trust that certificate once. In an elevated PowerShell window, in the folder you downloaded to:

Import-Certificate .\EPM-CodeSigning.cer -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate .\EPM-CodeSigning.cer -CertStoreLocation Cert:\LocalMachine\TrustedPublisher
(Get-FileHash .\EntraProfileMigration.msi -Algorithm SHA256).Hash   # compare with the SHA-256 above
msiexec /i .\EntraProfileMigration.msi /qn

Check that the certificate's thumbprint matches the one above before you trust it. To roll it out to many PCs, the package includes deployment\Trust\Install-EPMSigningTrust.ps1 for Intune, Group Policy or an RMM tool.

Run a migration

The installer puts epm.cmd in C:\Program Files\EntraProfileMigration, plus a Start menu shortcut for the step-by-step window. You need the user's Entra Object ID (Entra admin center, Users, the user, Overview).

epm /Preflight /SourceAccount .\john /TargetObjectId <object-id>
epm /Migrate /SourceAccount .\john /TargetUpn john@contoso.com /TargetObjectId <object-id> /OfferSecretRecovery
    (join the PC to Entra ID in Settings with john's account, sign out)
epm /Resume
    (restart; john signs in with his work account)
epm /Validate

Every command ends with a RESULT: line and an exit code that says what to do next: 0 done, 10 blocked (nothing changed), 20 restart, 21 waiting for the Entra join, 22 waiting for the user's sign-in, 30 rolled back. To undo, run epm /Rollback while the user is signed out.

Change notes

Every release is listed in the change notes, newest first. The download button above always points to the latest version.