Microsoft Configuration Manager
Device securityMigrate from MBAM
In brief
The documentation now explains how to retrieve existing MBAM groups with PowerShell and map them to equivalent Configuration Manager BitLocker portal groups during migration.
What Intune admins need to know
Administrators migrating from standalone MBAM can reuse existing access groups instead of creating new group mappings.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: Migrate from MBAM
description: Understand the considerations when migrating from Microsoft BitLocker Administration and Monitoring (MBAM) to BitLocker management in Configuration Manager.
ms.date: 12/01/20218/18/2026
ms.subservice: protect
ms.topic: upgrade-and-migration-article
ms.collection: tier3
To work around this behavior, first disable BitLocker on the device. Then deploy a new policy with the new settings.
Reuse MBAM groups
If you're migrating from a stand-alone MBAM deployment to Configuration Manager Bitlocker management, you can reuse your existing MBAM groups. To retrieve the groups, run the following PowerShell command on the MBAM application server:
Get-MbamWebApplication -AdministrationPortal | Select-Object AdvancedHelpdeskAccessGroup,HelpdeskAccessGroup,ReportsReadOnlyAccessGroup
For more information about the properties returned by the cmdlet, see Get-MbamWebApplication (MBAM).
When you set up the BitLocker portals in Configuration Manager, use the following portal-equivalent group mappings:
| MBAM Parameter | ConfigMgr Parameter |
|---|---|
| AdvancedHelpdeskAccessGroup | HelpdeskAdminsGroupName |
| HelpdeskAccessGroup | HelpdeskUsersGroupName |
| ReportsReadOnlyAccessGroup | MbamReportUsersGroupName |
Next steps
@@ -1,7 +1,7 @@ --- title: Migrate from MBAM description: Understand the considerations when migrating from Microsoft BitLocker Administration and Monitoring (MBAM) to BitLocker management in Configuration Manager.-ms.date: 12/01/2021+ms.date: 8/18/2026 ms.subservice: protect ms.topic: upgrade-and-migration-article ms.collection: tier3@@ -40,6 +40,24 @@ For example, you used MBAM to encrypt the drive with the AES-XTS 128 encryption To work around this behavior, first disable BitLocker on the device. Then deploy a new policy with the new settings. +## Reuse MBAM groups++If you're migrating from a stand-alone MBAM deployment to Configuration Manager Bitlocker management, you can reuse your existing MBAM groups. To retrieve the groups, run the following PowerShell command on the MBAM application server:++```PowerShell+Get-MbamWebApplication -AdministrationPortal | Select-Object AdvancedHelpdeskAccessGroup,HelpdeskAccessGroup,ReportsReadOnlyAccessGroup+```+ + For more information about the properties returned by the cmdlet, see [Get-MbamWebApplication (MBAM)](/previous-versions/powershell/module/mbam/get-mbamwebapplication). + + When you [set up the BitLocker portals](setup-websites.md) in Configuration Manager, use the following portal-equivalent group mappings:++ | MBAM Parameter | ConfigMgr Parameter |+ | ---------------|---------------------|+ | AdvancedHelpdeskAccessGroup | HelpdeskAdminsGroupName+ | HelpdeskAccessGroup | HelpdeskUsersGroupName |+ | ReportsReadOnlyAccessGroup | MbamReportUsersGroupName+ ## Next steps [About the BitLocker recovery service](recovery-service.md)