M&A Microsoft 365 Tenant Consolidation: The 90-Day Playbook

M&A Microsoft 365 tenant consolidation is a repeatable migration factory pattern, not a bespoke project. EPC Group's 216+ M&A migrations and 1.83 million users moved (2023-2025) converged on a single 90-day playbook used across PE-driven portfolio integrations, strategic acquirer programs, and Fortune 500 multi-tenant consolidations. The architecture pattern is the same across all three; the deal cadence and compliance overlay change.

See the parent practice at M&A Microsoft 365 Tenant Migration and the named reference pattern at /case-studies/patterns.

Phase 1 — Days 1-14: Identity-first sequencing

Identity is the hardest part to undo if done wrong, so it goes first.

• Day 1-3: Diligence handoff. Source and target tenant baselines. User counts, license inventory, mailbox sizes, OneDrive footprints, SharePoint site count, Teams count, Microsoft 365 group count, Power Platform footprint, custom app registrations, ISV integrations.
• Day 4-7: Identity architecture decision. Single forest vs. multi-forest. Hybrid identity vs. cloud-only. Conditional access policy harmonization. Identity governance baseline. Role assignment matrix.
• Day 8-11: Identity migration tooling staged. Cross-tenant access settings configured for B2B collaboration during transition. Migration tooling deployed and tested.
• Day 12-14: Identity migration begins (or planned start date confirmed). Pilot cohort of 50-100 users.

Phase 2 — Days 15-45: Content staging

Mail, files, Teams, SharePoint, Microsoft 365 groups, OneDrive — staged via approved tooling.

• Mail. Migrated via Microsoft-supported tenant-to-tenant migration tooling. Calendars, contacts, shared mailboxes, distribution lists. Delegate access preserved.
• OneDrive. Per-user OneDrive content migrated to target tenant OneDrive. Sharing relationships preserved where contractually permitted.
• SharePoint. Site collections migrated with permissions, content types, and lists/libraries intact. Modern pages and Web Parts preserved.
• Teams. Teams migrated with channel structure, owners, members, tabs, and files in the underlying SharePoint sites.
• Microsoft 365 Groups. Groups and their associated SharePoint sites + Outlook conversations migrated.
• Power Platform. Power Apps, Power Automate flows, Dataverse environments — where business-critical. Personal workspace Power BI content typically retired rather than migrated.

Phase 3 — Days 46-75: Compliance overlay

This is the phase most acquisitions skip and most regulators catch.

• Microsoft Purview classification mapping. Source-tenant sensitivity labels mapped to target-tenant equivalents. Labels travel with content through the migration so the regulatory record is preserved.
• DLP policy tuning. Target-tenant DLP tuned to handle incoming content patterns. Insider Risk Management policies harmonized.
• Audit log retention. Source-tenant audit logs preserved for the regulatory period before source-tenant decommissioning. Target-tenant audit log retention extended to cover the incoming user activity period.
• HIPAA / FINRA / FedRAMP / CMMC overlays. Where applicable, ensure migration preserves regulatory posture. For DIB contractors at CMMC L2, the source-tenant SSP boundary requires explicit decommissioning steps documented in the target-tenant SSP. See our Public Sector FedRAMP/CMMC playbook.
• eDiscovery preservation. Active legal holds and eDiscovery cases require explicit migration handling — typically via cross-tenant collaboration during transition rather than immediate consolidation.

Phase 4 — Days 76-90: Cutover and stabilization

• Day 76-79: Final delta sync. Catch all content changes since the previous migration pass. Verify completeness against checksums.
• Day 80-82: Cutover window. Domain cutover (UPN suffix changes, MX records, SPF/DKIM/DMARC). User communication. Go-live readiness check.
• Day 83-86: Stabilization. User support surge handled. Authentication issues triaged. Application connectivity verified (line-of-business apps, ISVs, partners).
• Day 87-90: Source tenant decommissioning prep. Final user offboarding from source. License termination plan. Compliance evidence archive. Decommissioning typically continues into days 91-120 with formal closeout.

The gotchas that consistently produce delay

• Multi-geo SharePoint and OneDrive. Cross-region data residency considerations require explicit migration sequencing.
• Power Platform automation embedded in core processes. Flows that nobody documented but everyone depends on. Surface these during diligence.
• ISV / partner integration tokens. OAuth grants and service principals need explicit re-authorization in target tenant. Catch this before cutover, not during.
• Calendar delegation. Executive assistants' access to executive calendars frequently breaks at cutover if delegation is not explicitly migrated.
• Shared mailboxes with retention. Compliance retention configured on source-tenant shared mailboxes does not automatically transfer.
• Stuck Teams conversations. Teams chat history migration is more complex than mail; chat history is often retained in source tenant for the regulatory period rather than migrated.

PE portfolio cadence

For PE portfolios with repeated deal flow, EPC Group operates as the continuous tenant-consolidation partner across the portfolio. Each deal close kicks off the 90-day playbook against the same target tenant, with the playbook refined per deal based on prior-deal learnings. The economic model is materially better than per-deal RFP cycles — pricing is pre-negotiated, runbooks are pre-built, and the 90-day timeline is repeatable.

See our Private Equity Microsoft Practice for the broader PE engagement pattern.

Where this connects

• M&A Microsoft 365 Tenant Migration — parent practice.
• Private Equity Microsoft Practice.
• Carve-Out Microsoft 365 Migration — the inverse pattern (divestiture).
• Reference Patterns — Multi-Tenant M&A Consolidation.
• Microsoft Purview Consulting — compliance overlay.
• Managed Microsoft Services — Operate stage post-cutover.
• The EPC Group Lifecycle.
• Public Sector FedRAMP/CMMC Playbook — when consolidation involves DIB tenants.
• Healthcare HIPAA-Native Fabric Architecture — when consolidation involves healthcare entities.
• Copilot-Ready Data Governance: The Purview Checklist — post-consolidation governance baseline.

Identity first. Content staged. Compliance overlay. Cutover in days 80-82. Stabilization through day 90. Multiple models. One truth. Consolidate accordingly.