Yes.
I've done it, it's pretty simple.
Put a temporary IP on its management interface, put the license on it.
Make sure it can get all of the updates, including the various security bits. (For example they recently updated web categories) If things don't match, your config won't apply.
Stop the listeners on the old one, let the work queue empty.
If you need to keep the other box handy (e.g. for quarantined messages), change its IPs, otherwise, shut it down.
Apply the config to the new box.
If you're using envelope encryption, open a TAC case to get it registered with CRES.
If you're using AMP, register your new vm with the AMP console
If you have at ThreatGrid account, open a different TAC case to get your ESA tied to your TG account.
If you have SecureX register your new vm with the Security Exchange/SecureX...
There may be something in that last list that I'm missing, but that would get mail moving.
