#Preparation

Before the migration, you need to identify what object types Fly supports. See the Supported and Unsupported List.

#1. Create app registration

Refer to the following steps to create an app registration:

1. In AOS, navigate to Administration > App registrations.

2. Click Create to create an app registration.

   

3. Enter a name for the app registration.

4. Click Add service and permission and select the checkbox of fly.admigration.readwrite.all.

5. Click Client secret tag and click Add client secret.

   NOTE

   Client secret values cannot be viewed, except for immediately after creation. Make sure to save the secret when created before leaving the page.

6. Click Save.

#2. Create source and destination connections

Refer to Create a Connection to connect Fly to your source and destination device.

#2.1 Domain trust

If you select to join Active Directory or Hybrid Identity domain with offline, refer to the following steps for domain trust:

1. From a Source Forest Domain Controller, launch Server Manager, using the Tools drop down menu to select Active Directory Domain and Trusts.

   

2. In Active Directory Domain and Trusts, right-click and choose Properties.

   

3. On the domain properties sheet, click the Trusts tab.

4. Click New Trust and then click Next on the Welcome to the Trust Wizard page.

   

5. On the Trust Name page, enter the name of the forest you want to establish trust with and then click Next.

   

6. On the Trust Type page, select External trust and then click Next.

   

7. On the Direction of Trust page, select Two-way and then click Next.

   

8. On the Sides of Trust page, select the domain you want to create the trust for and then click Next.

   

   NOTE

   To set the trust up for Both this domain and the specified domain, you will need the administrative privileges or know the administrator account and password for both domains.

9. On the Outgoing Trust Authentication Level page, select Selective authentication and then click Next.

   

10. On the Trust Password page, enter a password that the administrators from both forests have agreed upon as the trust password and then click Next.

    

11. On the Trust Selections Complete page, click Next.

12. On the Trust Creation Complete page, click Next.

13. On the Confirm Outgoing Trust page and the Confirm Incoming Trust page, click Next. You will not be able to confirm the trust until the target side has been completed or if you are creating both relationships at the same time.

    

14. On the Completing the New Trust Wizard page, click Finish.

15. On the Domain Properties page, click Apply.

16. Once the Forest Trust created, you must have an administrator for the Target Forest complete the same process using the password agreed upon when setting up the source side trust relationship.

    

    

17. Once both sides setup, you can then click Validate to validate the relationship from the Source Forest Active Directory Domain and Trusts Properties view for the outgoing trust.

    

    

    

#2.2 Generate and input the bulk enrollment file path.

If you select to join Microsoft Entra ID with offline, refer to the following steps to generate and input the bulk enrollment file path. You can refer to the official documentation of Install Windows Configuration Designer for details.

1. Install the Windows Configuration Designer in Microsoft store.

2. Open the designer and select the Provision desktop devices, enter the file name and path and then click Finish.

   

3. In the Set up device step, enter the device name and then click Next.

   

4. In the Set up network step, configure the network, you can set to off if no need and then click Next.

   

5. In the Account Management step, select Enroll in Azure AD, Refresh AAD credentials set to Yes, then click the Get Bulk Token and authorization and then click Next.

   

   

   NOTE

   The authorization account should belong to destination tenant that you want to join and make sure the authorized user selected in Users may join devices to Microsoft Entra.

   

6. Click Next to access the Finish step and then click Create to generate the file.

   

7. Copy the .ppkg file under the path to your device and copy the file path in your device to Bulk enrollment file path in destination connection.

   

   

#2.3 Cache user credential

If you select join to Active Directory or Hybrid Identity domain with offline domain join, and enabled Cache user credentials for device logon policy, you need to submit a cache credential user. You can refer to the Cache user credentials part in Manage Fly Device Agent for details.

You need to allowed cache credential user to authenticate OU of source domain before submitting cache credentials user, refer to the following steps :

1. In source domain controller, open the Active Directory Users and Computers.

2. Create a group and select Domain local and Security and then add the cache credential user to members.

   

   

3. Select the OU to which the source device belongs and open property.

4. Select the Security tab and click Advanced.

   

   NOTE

   If you cannot found the Security, click View and enable Advanced Features in menu of active directory.

5. Click Add to add permissions.

   

6. Select the created group in Principal section, select Allow in Type section and select Descendant Computer objects in Applies to section. Then select the permission Allowed to authenticate.

   

7. Click OK to save.

After allowing cache credential user to authenticate OU of source domain, you can submit cache credentials users.

In the lower-right corner of the device, right-click Fly, click Cache user credential, input your cache credential user and then click Submit.

#3. Set destination domain controller IP

Set the correct destination domain controller IP in the device DNS for AD and Hybrid domain rejoin and make sure it can be looked up.

#4. Install and Configure Device Agent

#4.1 Install Device Agent

Two ways to install Device Agent:

• Install Device Agent with GPO - IT manager can use Group Policy to remotely install Device Agent for all workstations that do the rejoin domain. Refer to Microsoft documents about how to use the GPO. If you need to install agents with configuration key by command or MST file transform, the key is CONNECTION and the value is your configuration key value of source connection.

• Install device agent with Intune - Make sure your devices already have joined Microsoft Intune. Refer to Microsoft documents about how to use the Intune. If you need to install agents with configuration key, you can modify the install command: msiexec /i "AgentName.msi" /qn CONNECTION="ConfigurationKeyValue" when you add an app.

Sign in to your device and refer to the following steps to install device agent:

1. In Welcome to the Device Migration Setup Wizard page, click Next.

   

2. Read the license agreement and select the checkbox to accept it and then click Next.

   

3. Select the installation path and click Next.

   

4. Enter the configuration key of device connection you generated and click Next.

   

   NOTE

   By pasting the configuration key generated in the Fly browser into the installer, the Device Agent will automatically configure itself, ready for you to run the device rejoin.
   When you open the agent after installation, you will see that all connection fields (AOS and Fly connection) are already filled with the correct values. You can also change the configuration information to connect other connections of Fly and customize Proxy settings if needed. Everything else is ready for you to start the rejoin domain job.

5. Click Next to access the Configure Device Migration Agent page.

6. In the Configure Device Migration Agent step, define how the Fly Device Agent behaves locally on the machine and how frequently it communicates with the central migration server.

   

   • Job Polling Interval – Enter an integer from 10 to 1440 minutes to specify how often the local agent should check the server for new jobs. The default is 60 minutes, meaning the agent checks for new commands/jobs once an hour.

   • Behavior Settings

     • Prevent computer from sleeping – With this checkbox selected, this instructs the device to avoid sleep or hibernation modes. This is a critical setting that ensures the device remains active to receive migration commands, especially during out-of-hours or weekend cutovers.

     • Enable Unattended Mode – With this checkbox selected, the agent installs and runs completely silently in the background. It prevents the application UI from auto-launching and stops the creation of desktop shortcuts, making it ideal for invisible, enterprise-wide deployments where end-users' interaction is not needed.

     • Enable Automatic Updates – With this checkbox selected, the agent will automatically download and apply new version updates as they become available, ensuring the local device always has the latest features and bug fixes without requiring manual IT intervention.

7. Click Install to begin the installation.

   

#4.2 Configure Device Agent

To ensure your data remains secure and is routed to the correct destination during migration, the Fly Device Agent requires specific authentication credentials.

Refer to the following steps to configure the Device Agent:

1. In the lower-right corner of the device, right-click Fly and then click Configuration.

   

2. Enter the AvePoint Online Services application (client) ID and Client secret and then click Next.

3. Enter the source device Connection key and click Verify. You can open the device connection of Fly to view the connection key.

   

4. Configure the Advanced settings for the local device agent if required, including job check frequency and system power overrides.

5. Click Finish.

You can see the device agent in Fly after finishing the above steps.

#Unattended Mode Deployments

If the agent is deployed using Unattended Mode, the agent configuration window and the taskbar system tray icon will not be visible on the device.

Unattended mode is specifically designed to run quietly in the background. It ensures that the end-user using the device is not interrupted by configuration pop-ups, system tray notifications, or prompted to enter security credentials they do not have.

The required security settings, AOS Client ID, Client Secret, and Connection Key are still required. However, instead of being typed into a window manually, your administrator will automatically inject these values into the installation using command-line parameters or automated deployment tools like Microsoft Intune or SCCM.

The agent will still authenticate and connect securely to AvePoint Online Services, but the entire process will remain completely invisible to the device owner.

To deploy the Device Agent silently via command line or endpoint management tools (like Microsoft Intune), you can use the following syntax:

msiexec /i "\\SERVER\path\to\package\Fly_DeviceAgent_X.XX.XX.XXXX.msi" /qn UNATTENDED=true CONFIGURATIONKEY=<Your configuration key> JOB_DURATION=<Minutes> AGENTAUTOUPDATE=true|false KEEPAWAKE=true|false

The following parameters are configurable:

UNATTENDED - Set this to true to enable Unattended Mode. The installation and the agent will run entirely in the background without displaying any user interface (UI) to the end-user.

CONNECTION - The configuration key will automatically be retrieved from Fly and provide the used values for Device Agent.

JOB_DURATION - Defines the polling interval (in minutes). This dictates how frequently the Device Agent checks the server for new migration tasks.

#5. Create a migration policy

A device migration policy allows you to define the mappings, areas, and areas to ignore. Refer to Create a Migration Policy for details.