Nexune Migrate
Zero-touch M365 migrations, with receipts.
Move every Windows device from one Microsoft 365 tenant to another — identity, profile, mail, files, Intune, BitLocker — fully automated. Every action is cryptographically signed and WORM-notarized. Your auditors will love it.
- WS-LON-2284SOURCE_CLEANED → DST_JOINEDRunning
- WS-LON-2103INTUNE_ENROLLEDRunning
- WS-NYC-0641PROFILE_REATTACHEDDone
- WS-NYC-0782PREP_BL_ESCROWRunning
The problem
Mergers move money. Migrations move devices.
Most M365 migration tools move mail, files, and SharePoint. They don't touch the devices — and the devices are the hard part. Domain join, Intune re-enrollment, BitLocker escrow, profile swap, app reinstall. Today, that's weeks of fragile manual work per device.
per device in manual M&A migrations.
fragile PowerShell scripts holding the migration together.
audit-grade evidence of who did what, when, where.
What it does
Four verbs. One product.
Discovers
Every device, every user, every mapping conflict. Microsoft Graph scan, dedupe by serial, readiness scored 0–100 with blockers surfaced before you commit.
Prepares
BitLocker keys escrowed. Provisioning packages built per-customer. Per-device .intunewin agent Authenticode-signed. Two approvers gate production change.
Migrates
A 12-phase state machine drives every device. Idempotent, resumable, observable. Zero user interaction. Per-device session queues with retry + quarantine.
Proves
Hash-chained audit log. HSM-signed by approvers. WORM-notarized into immutable blob storage every 60 seconds. Every action, every device, forever.
Live status, by design
Every wave streams live. No refresh. No spreadsheet.
- Per-wave + per-device live progress— SSE; resume after disconnect via Last-Event-ID.
- 12-phase timeline per device— with timestamps, elapsed seconds, retries.
- Pause, abort, retry — without dropping the audit chain
- WS-LON-2284SOURCE_CLEANED → DST_JOINEDRunning
- WS-LON-2103INTUNE_ENROLLEDRunning
- WS-NYC-0641PROFILE_REATTACHEDDone
- WS-NYC-0782PREP_BL_ESCROWRunning
Two-approver production
Production change happens with two pairs of eyes — and an HSM.
- HSM-backed signatures— Azure Key Vault Premium, versioned kid stamped on every receipt.
- SoD enforced— creator ≠ approver ≠ executor.
- ≤ 24h freshness— stale approvals are rejected by the control plane.
What employees see
No tickets. No surprises. No 'have you tried restarting?'
- Defer 4h or 24h— capped at 2 per device, audited.
- Start now— surface the wave to the front of the queue.
- Customer branding— logo, support email, accent color per customer.
j.kowalski@contoso.com · WS-NYC-0641
Your device will join the new Microsoft 365 tenant. You don't need to do anything. Save your work and leave it powered on.
Questions? it-help@nexune.in
Security, the whole way through
Built so your auditors don't have to take our word for it.
HSM signing
Azure Key Vault Premium HSM signs every approval and every notarization receipt. Versioned kid stamped on every record.
Hash-chained audit
Every audit row has prev_hash + this_hash. Tamper-evident. No log entry can be silently changed or removed.
WORM notarization
Every 60 seconds, a per-customer batch is uploaded to immutable blob storage with a 7-year locked policy.
SQL RLS tenancy
SQL Server Row-Level Security on every per-customer table. SESSION_CONTEXT enforces customer_id on every connection.
Two-approver gate
Waves above 100 devices require a second approver. SoD prevents the creator from signing.
Idempotent state
14-state device-run machine. Every transition keyed by (device_run_id, target_state). Replay-safe end to end.
Built on what your auditors already trust
- Microsoft Graph
- Azure Key Vault HSM
- Azure SQL Ledger
- Microsoft Intune
- Authenticode
- AAD Multi-tenant
Compare
The device side of M365 migration is where every tool stops. We start there.
| Capability | Nexune Migrate | BitTitan | ShareGate | Quest | DIY scripts |
|---|---|---|---|---|---|
| Device-level migration (not just content) | Manual | ||||
| Identity + profile SID swap | Manual | Manual | |||
| BitLocker escrow + re-encryption | Manual | ||||
| Cryptographically signed audit |
Outcomes
What 'zero-touch' looks like in numbers.
Numbers below are from a real-world pilot deployment between two Microsoft 365 tenants. We'll publish customer case studies as the first wave of paying customers go live.
"We migrated 284 devices in a six-hour window. The help-desk inbox stayed empty. The audit log answered every question my CISO asked the next morning."
Ready to migrate without touching a single device?
A 30-minute call to see the operator console, walk a live wave, and look at the audit chain. No deck, no script.