Skip to content

Device migration

You can migrate computers from one Sophos Central account to another for your sub-estates. You might want to move devices between sub-estates or to a new sub-estate.

To migrate computers you need to do as follows:

  1. Turn on device migration for the Sophos Central accounts. See Turn on device migration.
  2. Use the Endpoint API to migrate the computers. See Migrate computers using Endpoint API.
  3. Review the migration results in Sophos Central. See Review the migration results.


To migrate computers you must be an administrator for both accounts. You need to have the Enterprise Admin role. See Administrators.

You also need API credentials for both accounts. You need to have Service Principal Super Admin credentials. API Credentials Management.

To migrate computers you use our Endpoint API. Check the following:

For more information on the Endpoint API see Endpoint API.

Turn on device migration

If you turn on migration it applies to all sub-estates that the template is assigned to. We recommend that you review the sub-estates the template applies to if you want to use an existing template.

If you clone a template check that the other global settings and base policies are correct for your sub-estates.

You need to make sure that the sub-estate accounts you're moving devices between are assigned to your template.

The account you're moving devices from is your sending account. The account you're moving devices to is your receiving account.

To turn on migration, do as follows:

  1. Go to Settings & Policies > Global Templates.
  2. Select a template. You can then edit or clone it.

    See Template.

  3. Click Sub-estates and either add your sub-estates or check that the template is assigned to them.

  4. Click Global Settings and then click Device Migration.

    Device migration.

  5. Turn on Allow device migration.

    Device migration settings.

  6. Set a time limit for migrations.

    We recommend that you allow migrations for a limited time period.

  7. Click Push to sub-estates and then click Push to confirm.

    You need to push the template to your sub-estates. Changes take effect after you have pushed the template.

All assigned sub-estates have their base policies and global settings locked in Sophos Central Admin.

Migrate computers using Endpoint API

To migrate computers between Sophos Central accounts you use our Endpoint API. These instructions summarize the steps you need to do using the API commands. For detailed information on how to use the commands see Endpoint API.

To migrate computers, do as follows:

  1. For the Sophos Central account you want to move computers to, do as follows:

    1. In your Receiver enviroment, create a receiving job for the endpoints.

      You will get an access token when you do this. You need this to create the sending job for the other Sophos Central account. You also need the ID for the receiving job.

  2. For the Sophos Central account you want to move computers from, do as follows:

    1. Get a list of endpoints you want to migrate.
    2. In your Sender environment, create a sending job with the list of endpoints, the access token and the ID from the receiving job you set up for the other Sophos Central account.

      This starts the migration.

You can check the progress of the migration in the API. You can get more detailed information in Sophos Central.

Review the migration results

You can use the event and audit logs in your Sophos Central accounts to check the migration has been successful. You can also check the receiving Sophos Central account for the migrated devices.

In your sending account check your audit log. You should see a "Send endpoints to another tenant" event.

You also need to check your computers. Go to the Events tab for each computer. For each computer that did migrate you should see "Device registered with new account <AccountID>. It's now managed by that account".

For each computer that didn't migrate you should see "Device failed to register with new account <AccountID>. It continues to be managed by this account".

In your receiving account check your audit log. You should see an "Allow endpoints to migrate to this tenant" event.

You also need to check your computers. Go to Overview > Devices and then click Computers. You should see your migrated computers. Click on a computer to check it. For each migrated computer, you should see that it has been registered, a user assigned to it and that it has been updated.