Migrated software packages preserve package options and programs, but they do not become applications automatically. They remain package objects until teams convert them, typically with Microsoft’s Package Conversion Manager. That distinction matters because application model deployment supports a different management approach, so migration does not eliminate the need to redesign packaging decisions after the move.
Why migrated packages are not the same thing as ConfigMgr 2012 applications
Migrated software packages keep the package object model, including program settings and deployment behavior, even after import. ConfigMgr 2012 applications are a separate application-centric model with different rules for detection, requirements, dependencies, and revisioning. The migration process preserves what existed; it does not reinterpret package content as an application.
That distinction is why a migrated package can still behave like a package after a move. If teams expect the new model automatically, they can misread how deployment evaluation, user targeting, and compliance state are actually being handled.
What survives migration, and what does not
A migrated package usually brings across the package definition and the programs attached to it, which is useful when the goal is continuity. What does not come across is the application object structure, because applications are not just renamed packages. They introduce a different abstraction for deployment intent and state.
In practice, this means the package can still be distributed and run as before, but it will not suddenly gain application features such as richer detection logic or application-type deployment behavior. Teams often use Microsoft’s Package Conversion Manager to turn suitable packages into applications when they want to adopt the new model deliberately. Microsoft Package Conversion Manager
Why the difference matters operationally
Package and application management solve adjacent but different problems. Packages are usually closer to execution of install commands and program choices, while applications model whether software should be installed, required, available, superseded, or detected on a system. That shift changes how administrators design deployments and how they verify success.
The practical consequence is that migration can preserve operational continuity while leaving your packaging strategy unchanged. If you need application-level control, you still have to redesign the software delivery approach rather than assume migration produced that outcome for you.
Risk and Threat Considerations
The main risk is configuration drift: teams may believe they are managing applications when they are still managing legacy package objects. That can create uneven enforcement, inconsistent detection, and deployment outcomes that do not match the new management model.
Failure mechanism: Migration preserves the package structure, so administrators may continue to rely on package assumptions even after moving to ConfigMgr 2012, leaving application-specific controls unimplemented.
Impact: Software can appear deployed without the lifecycle, detection, or dependency handling that application management was meant to provide, which increases troubleshooting effort and weakens deployment governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-2 — Inventory and Control of Software Assets | Migrated packages vs applications affects how software assets are tracked and governed. |
| Recommendation — Inventory migrated packages separately from converted applications and update software asset records. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | Migration can preserve legacy package objects, so inventory accuracy matters for control visibility. |
| CM-2 — Baseline Configuration | The question turns on preserving one deployment model versus redesigning to another baseline. | |
| Recommendation — Track migrated package objects and application objects distinctly in the component inventory. Define separate configuration baselines for package-based and application-based deployments. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Migration changes how software is configured and controlled after transition. |
| Recommendation — Document whether each deployment is still package-based or has been converted before release. | ||
Practitioner Guidance
What to verify: Confirm whether each migrated object is still a package or has been converted into an application before you change deployment standards or reporting expectations. If the team needs requirement rules, detection methods, or deployment types, treat conversion as a separate design task rather than a migration byproduct.
Decision rule: Keep migrated packages when the objective is continuity and minimal change; convert to applications when the objective is policy-driven deployment control and clearer compliance behavior.
Practitioner takeaway: The safe assumption is that migration preserves packaging, not intent, so software governance should be reviewed again after the move instead of treated as automatically modernized.
Related resources from NHI Mgmt Group
- What is the difference between privilege reduction and secret rotation?
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- What is the difference between code scanning and runtime identity monitoring?
- What is the difference between zero trust for users and zero trust for NHIs?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
