Migrating from MBAM to SCCM: A Step-by-Step Guide to a Smooth Transition

When it comes to managing and securing client devices, Microsoft offers two powerful tools: Microsoft BitLocker Administration and Management (MBAM) and System Center Configuration Manager (SCCM). Both solutions provide robust encryption and management capabilities, but they have different features and functionalities. In this article, we'll explore the process of migrating from MBAM to SCCM's BitLocker Management feature.

Before we dive into the migration process, it's essential to note that you should keep your GPO settings in MBAM consistent with your ConfigMgr Bitlocker policy. This will help prevent conflicts and ensure a smooth transition. If you don't, you may encounter unexpected results during the migration process.

When migrating clients from MBAM to SCCM's BitLocker Management feature, the recovery key and associated data will be automatically populated in ConfigMgr's database without requiring any additional configuration. The process is straightforward: simply pre-configure your BitLocker Management policy and target the desired computers with that policy.

In the screenshot below, you can see the ConfigMgr database on the left and the MBAM database on the right. As you can see, the client previously managed by MBAM is now being managed by ConfigMgr, and the key and its associated data have been successfully migrated over to ConfigMgr.

The Configuration Manager server plays a crucial role in this process, as it deploys the MDOP agent (MBAM client) to resources in the MBAM Clients collection. This collection uses a membership query to look for resources within the MBAM Clients OU. Once deployed, the MBAM managed clients receive group policy settings that instruct them to report to the MBAM server and upload compliance data and recovery keys.

To facilitate this process, you'll need an existing MBAM standalone server(s) that is managing one or more clients. In the video linked below, we demonstrate how to migrate existing MBAM managed clients to Configuration Manager using SCCM's new BitLocker Management feature, which was released in Microsoft Endpoint Configuration Manager version 1910.

By following these steps and best practices, you can ensure a seamless migration from MBAM to SCCM's BitLocker Management feature. This will enable you to take advantage of the advanced encryption and management capabilities offered by SCCM while minimizing disruptions to your existing infrastructure.

Mbam sccm