SECURITY · November 11, 2026 · 6 min read
Fully isolated SharePoint migrations: your files and your job data stay in your network
“Your files never pass through our servers” has become the standard promise for desktop migration tools. It’s a good start, but it covers only the file contents. A migration produces a second set of data that security teams care about just as much: the file inventory, every file and folder name and path, the names and email addresses behind Created By and Modified By, error messages, and the job log.
Folder names alone can say a lot: HR/Terminations/2026, Legal/Acquisition-Project, Finance/Payroll. With MigrationFox Pro, the Windows app can run fully isolated on your PC: the files and everything about the migration stay inside your network.
What stays on the PC
- File contents. They go straight from the source to the destination through the PC. They never pass through MigrationFox.
- Job data. File lists, file and folder names and paths, people’s names, errors, logs and job details are kept on the PC, encrypted with Windows. MigrationFox receives nothing about these migrations.
- Sign-ins. Sign in to SharePoint and OneDrive on the PC, with MigrationFox’s app, your organization’s own app registration or a certificate. The sign-in is saved on the PC and never sent to MigrationFox.
- Reports. Report a problem can save the report to a file for you to review and send yourself. Names, paths, sites and email addresses are replaced with placeholders.
What the PC still sends, in each mode
One setting controls it: Settings → What this PC sends to MigrationFox web.
| Standard | Standard plus counts | Strict | |
|---|---|---|---|
| Migrations kept on the PC | Nothing | Kind, status, file and size counts; no names, paths, errors or logs | Nothing |
| Online status, migrations started on the web | Yes | Yes | No |
| Update checks | Yes | Yes | No |
| License renewal | Yes | Yes | Yes, the PC’s machine ID only |
In Strict mode, the only call to MigrationFox is the license renewal. For a PC that can’t reach MigrationFox at all, create an offline license file on the Devices page and import it on the PC.
Built for the security review
- Every address, listed. Settings → Network shows every address the PC contacts, why, and what is sent, with a Copy list button for the firewall request. In PowerShell:
Get-MFNetworkRequirement. - Set by policy. IT can turn on Strict mode with a machine policy (
HKLM\Software\Policies\MigrationFox,Connectivity=Strict) or at install (/STRICT=1, with a license key from the Devices page). Users can’t turn it off. - Nothing listens. All traffic is outbound HTTPS on port 443. No inbound firewall ports, no VPN.
- Code-signed. The installer is signed by MigrationFox Inc., a Microsoft Verified Publisher.
What it covers
Isolated migrations run from the Windows app for SharePoint and OneDrive (including True History, which keeps original authors, dates and versions), file shares and local folders to SharePoint or OneDrive, and InfoPath PDF archives. They need MigrationFox Pro, or its free 14-day trial.
What you give up is visibility from anywhere else: the web dashboard doesn’t show these migrations (unless you choose Standard plus counts), and they can’t be started from the web. Other platforms, such as Google Drive, Box and Dropbox, run with job data kept on MigrationFox web.
Turn it on
- Install the Windows app and sign in (or, in Strict mode, enter a license key).
- Open Settings → Where job data is kept and choose This PC only.
- Under Connections, sign in to SharePoint and OneDrive on the PC.
- Optional: under What this PC sends to MigrationFox web, choose Strict.
Migrations already running finish where they began; the setting applies to new migrations. More detail is on the Windows app page and the Trust page.