Lessons from Consolidating 3 Microsoft 365 Tenants into 1 (Anonymous M&A Case Study)

Anonymous Case Study: 3-Tenant Consolidation into 1

This is an anonymized case study from a recent EPC Group engagement. Names changed, key details preserved. Used with client consent under NDA. Pattern is common in industrial services + manufacturing + healthcare M&A.

Client Profile

• Industry: Industrial services (acquirer) acquiring two subsidiaries through M&A
• Tenants: 3 separate Microsoft 365 tenants (Parent, Sub-A, Sub-B)
• Total workforce: 752 mailboxes, 12+ TB of SharePoint + OneDrive data
• Workloads in scope: Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, Power Platform (Power Apps + Power Automate flows), Microsoft Intune (managed endpoints), Dynamics 365 Customer Engagement
• Goal: Single unified tenant within 18 months of M&A close
• Compliance scope: SOX (publicly traded acquirer) + cybersecurity insurance underwriting requirements

Engagement Scope (52 weeks total)

Phase 1 (Weeks 1-6): Pre-Migration Discovery

• Tenant inventory across all 3 environments (Microsoft 365 Admin Center + Microsoft Graph API audits)
• Identity mapping: 3 separate Entra ID tenants, ~270 cross-tenant collaboration scenarios
• Data inventory: 12+ TB SharePoint, ~4 TB OneDrive, 752 mailboxes (avg 35GB), ~180 Power Apps
• Custom solution audit: 12 Power Apps, 47 Power Automate flows, 8 SharePoint Designer workflows (legacy)
• Compliance baseline: existing Purview labels (inconsistent across 3 tenants), DLP policies (drift), Intune compliance policies (different baselines)

Phase 2 (Weeks 7-14): Coexistence Strategy

• Cross-tenant access (Microsoft 365 Cross-Tenant Sync via Entra) for transition period
• Email coexistence: SMTP relay + Free/Busy federation
• SharePoint coexistence: SPO Cross-Tenant collaboration (B2B sharing)
• Identity: Sync subsidiaries' users to parent tenant via Entra B2B initially, native account migration in Phase 3
• Critical decision: ShareGate Migrate (primary tool) + Microsoft Migration Manager + Mover (OneDrive specifically) + native Exchange Online cross-tenant migration

Phase 3 (Weeks 15-30): Wave-Based Migration

• Wave 1 (Weeks 15-20): Sub-A mailboxes + OneDrive (smaller, less complex)
• Wave 2 (Weeks 21-26): Sub-A SharePoint sites + Teams (preserve permissions, hub topology remap)
• Wave 3 (Weeks 27-30): Sub-B full migration (larger, more custom solutions)
• Power Apps: replatformed 12 apps from sub tenants to parent (Power Platform Center of Excellence templates)
• Intune: rebuilt compliance policies + Conditional Access from scratch using parent tenant as baseline

Phase 4 (Weeks 31-44): Cutover + Validation

• Final DNS cutover per subsidiary, 30-day source read-only period
• Permission audit + drift remediation
• SharePoint hub topology consolidation (3 hub topologies merged into 1)
• Purview retention + sensitivity label deployment across consolidated tenant
• Communication Compliance + Insider Risk policies operational

Phase 5 (Weeks 45-52): Post-Go-Live Cleanup + Optimization

• ROT removal (40% content reduction from acquired tenants)
• License rationalization: $1.2M annual savings vs maintaining 3 separate tenants
• Copilot readiness preparation (Phase 6 future scope)
• Hypercare team handoff

Outcomes

Migration metrics:

• 752 mailboxes migrated, 0 lost
• 12+ TB SharePoint + OneDrive data migrated, 99.97% fidelity (specific issues remediated)
• 47 Power Automate flows replatformed
• 12 Power Apps replatformed
• 180 Intune-managed endpoints re-enrolled
• Cutover downtime per subsidiary: less than 4 hours (weekend windows)

Financial impact:

• License rationalization annual savings: $1.2M (consolidated to fewer tenants)
• M&A integration savings: $3.8M deferred IT integration cost vs maintaining parallel tenants
• Total Year 1 net value: ~$5M

Compliance + governance:

• SOX-eligible audit trail consolidated to single tenant
• Cybersecurity insurance underwriting requirements met
• Purview retention policies operational
• Unified Conditional Access + Intune posture

9 Lessons Learned

1. Pre-migration permission audit is non-negotiable.
3-tenant consolidations multiply the oversharing risk. We found 23 SharePoint sites in Sub-A with org-wide "Everyone" permissions including financial data. Required 6 weeks of remediation BEFORE migration.

2. Power Platform replatforming takes 30-50% longer than estimated.
12 Power Apps and 47 Power Automate flows. Direct lift-and-shift is rarely possible. Connectors, environment variables, premium licensing all require re-validation. Budget 2x what tooling vendors estimate.

3. Intune is the riskiest workload in M&A consolidation.
Different baselines, different Conditional Access policies, different compliance posture. Endpoint re-enrollment causes user friction. Always pilot 10-20 endpoints per subsidiary BEFORE wave rollout.

4. SharePoint Designer workflows MUST be inventoried + replatformed early.
8 legacy SharePoint Designer workflows in Sub-B. None migrate to modern SharePoint Online. Replatformed to Power Automate (6 of 8) or retired (2 of 8). 4-week effort that gets forgotten in initial scoping.

5. Cross-tenant collaboration (B2B) is a transition crutch, not a destination.
External-collaboration permissions accumulated during the 30-week coexistence period. Post-migration cleanup of B2B guest accounts took 4 weeks.

6. License rationalization is the easiest CFO win.
Annual savings: $1.2M from consolidating duplicate E5 + add-on licenses. Document this BEFORE the migration so the CFO sponsors continued investment.

7. Communication compliance + DLP policies should be rewritten, not merged.
Trying to merge 3 different DLP policy sets created 200+ false positives in Week 1. We threw out the merged policies and rebuilt from scratch using parent-tenant baseline + subsidiary-specific overlays.

8. Hub topology consolidation needs IA redesign.
3 different SharePoint hub topologies (departments, business units, geography) don't merge cleanly. Required 8 weeks of stakeholder workshops + new IA before final consolidation.

9. Post-go-live cleanup is 30% of total engagement effort.
Decommission, B2B guest cleanup, license rationalization, hypercare. Easily underestimated in initial scoping. Always include explicit Phase 5 in SOW.

What's Next

Year 2 roadmap at this client:

• Microsoft 365 Copilot deployment on consolidated tenant (now possible because oversharing remediated)
• Microsoft Agent 365 governance integration
• Power Platform Center of Excellence operationalized
• Quarterly tenant health + license review

Frequently Asked Questions

Q: How long does a 3-tenant consolidation take?
A: 12-18 months for similar-complexity environments. 6-12 months for smaller (less data, fewer Power Platform customizations).

Q: What is the typical investment for this scope?
A: Range $500K-$2.5M consulting + tooling depending on tenant complexity, data volume, customization depth. Add internal IT bandwidth.

Q: Why not use Microsoft Cross-Tenant Sync permanently?
A: Cross-Tenant Sync is good for coexistence but creates operational complexity, license sprawl, and audit-trail fragmentation long-term. Single tenant is the destination.

Q: What tools do you recommend?
A: ShareGate Migrate for SharePoint + OneDrive (primary), Microsoft Migration Manager + Mover for OneDrive bulk, native Exchange Online cross-tenant migration, AvePoint FLY for complex Nintex environments.

Q: Can Copilot be deployed during the consolidation?
A: Not recommended. Copilot grounds on Microsoft Graph + surfaces oversharing exposure. Wait until consolidation + permission remediation complete (Phase 5 minimum).

Q: Why EPC Group?
A: 29 years Microsoft consulting. Hundreds of M&A tenant consolidations across industrial, healthcare, financial services. Microsoft Solutions Partner with all six designations under the Microsoft AI Cloud Partner Program. See /reviews.

Next Steps

• Schedule discovery: /contact
• Productized assessment: /services/m-and-a-tenant-migration-assessment
• Full M&A service: /services/m-and-a-microsoft-365-tenant-migration
• Call (888) 381-9725