How should teams prepare a Configuration Manager migration when the source environment cannot be upgraded in place?

Why the migration must be designed around the target hierarchy first

When the source site cannot be upgraded in place, the migration is not a simple version jump. The target configuration manager hierarchy becomes the thing that determines how roles, clients, boundaries, and update flow will behave. That means planning the destination design first is not administrative overhead, it is the prerequisite that makes the migration path possible.

The practical issue is sequencing. If the destination hierarchy is incomplete, migration tasks have nowhere stable to land, and teams end up troubleshooting architecture decisions midstream instead of executing a controlled move.

What has to be in place before you move anything

The source environment should be checked against the supported baseline before the migration starts, because an unsupported starting point can invalidate the process even if the destination is ready. Required site roles and services also need to be installed in the target design up front, since migration depends on those components existing before content, clients, or boundaries can be rehomed.

For this reason, teams should treat boundary design and role placement as part of the migration plan, not as a post-migration cleanup item. If those elements are still open questions, the project is really still in design, not execution.

How teams should sequence the work to avoid stalls

Start by documenting the target hierarchy, then validate that the source environment can be migrated from the state it is in today. Only after that should teams begin moving the site roles, client-management functions, and boundary logic into the new structure. That ordering reduces rework because each migration step can be tested against a known destination model.

A good rule is to block migration tasks until the target layout is approved and the minimum services are online. If the design is still changing, the safest move is to finish the hierarchy decision first rather than forcing partial migration work that will have to be undone later.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.SC-02 — Cybersecurity Supply Chain Risk Management	Migration depends on a supported baseline and prerequisite components.
Recommendation — Validate prerequisite dependencies before moving the environment.
NIST SP 800-53 Rev 5	CM-2 — Baseline Configuration	The source and target need a defined baseline before migration proceeds.
	CM-6 — Configuration Settings	Roles, services, and boundary settings must be defined in the target design.
Recommendation — Establish and approve the migration baseline before implementation. Document and apply the required configuration settings in the destination hierarchy.
ISO/IEC 27001:2022	A.8.9 — Configuration management	The question is about preparing a controlled configuration change before migration.
Recommendation — Control and review configuration changes as part of migration planning.
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Teams must confirm the target environment is correctly built before migration.
Recommendation — Standardize and verify the destination configuration before cutover.

Practitioner Guidance

What to verify: Confirm the target hierarchy, required site roles, and boundary design are all documented and installed before scheduling cutover work. Also verify the source environment is on a supported baseline, because an unsupported source often becomes the hidden reason a migration cannot progress.

Implementation sequence: Freeze the destination design first, validate prerequisites second, and only then begin execution steps that depend on the new hierarchy. This keeps migration from becoming an iterative redesign exercise.

Practitioner takeaway: If the source cannot be upgraded in place, the migration succeeds or fails on preparation discipline, so finish the target design before you try to move the environment.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.