Microsoft 365 Tenant-to-Tenant Migration
Enterprise M&A guide for mergers, acquisitions, and divestitures. Cross-tenant migration, mailbox moves, SharePoint content, Teams data, identity management, and DNS cutover.
Why Tenant-to-Tenant Migration Happens
Featured Snippet: Microsoft 365 tenant-to-tenant migration moves users, mailboxes, OneDrive files, SharePoint sites, Teams channels, and identity objects from one Microsoft 365 tenant to another. It is triggered by mergers and acquisitions (consolidating two companies into one tenant), divestitures (extracting a business unit into a separate tenant), or rebranding (moving to a new primary domain). Microsoft provides the native Cross-Tenant Migration tool for mailboxes and OneDrive, while SharePoint and Teams require third-party tools like ShareGate or AvePoint. A typical enterprise migration (5,000+ users) takes 4-9 months including coexistence, phased data migration, DNS cutover, and decommissioning.
Every M&A transaction involving Microsoft 365 tenants eventually requires a tenant-to-tenant migration. The acquiring company wants one unified tenant for identity management, security policies, and licensing efficiency. The divested business unit needs its own tenant to operate independently. The rebranding company needs to shed its old domain and tenant identity. In every case, the technical challenge is the same: move users and their data from one Microsoft 365 tenant to another with minimal disruption.
Tenant-to-tenant migration is fundamentally different from on-premises-to-cloud migration. Both tenants are already in Microsoft 365 — the challenge is not getting data into the cloud, but moving it between two separate cloud environments that share no administrative trust by default. Microsoft 365 tenants are designed as isolated security boundaries, so every aspect of the migration requires explicit cross-tenant configuration.
EPC Group has executed tenant-to-tenant migrations for organizations ranging from 500 to 50,000+ users across healthcare, financial services, manufacturing, and technology sectors. Our Microsoft 365 consulting practice manages the entire lifecycle — from M&A due diligence and tenant assessment through coexistence configuration, phased migration, DNS cutover, and source tenant decommissioning. This guide covers every technical dimension of tenant-to-tenant migration.
M&A Reality: Tenant migration is often on the critical path of M&A integration timelines. Deal terms frequently mandate IT consolidation within 6-12 months of close. Starting migration planning during due diligence (before the deal closes) can accelerate the timeline by 4-8 weeks — EPC Group offers pre-close assessment engagements for this purpose.
Migration Scenarios
Tenant-to-tenant migration is triggered by three primary business events, each with unique technical challenges.
Merger / Acquisition
Two companies merge and need to consolidate into a single Microsoft 365 tenant. Typically the acquiring company's tenant becomes the target, and the acquired company's users, data, and applications migrate into it.
Key Challenges:
- Different domain namespaces
- Conflicting conditional access policies
- Duplicate distribution groups
- License consolidation across different EAs
Divestiture / Spin-Off
A business unit is sold or spun off and must be extracted from the parent company's tenant into a new or different tenant. Data must be surgically separated without disrupting the remaining parent organization.
Key Challenges:
- Identifying all data owned by the divested unit
- Shared mailboxes and distribution groups
- Separating SharePoint sites with cross-unit permissions
- Timeline pressure from deal closing dates
Rebranding / Domain Change
An organization rebrands and needs to move to a new primary domain or tenant. Often triggered by company name changes, holding company restructuring, or moving from a legacy Office 365 tenant to a modern Microsoft 365 tenant.
Key Challenges:
- Maintaining mail flow continuity during domain transfer
- Updating all user UPNs and email addresses
- Client-side reconfiguration (Outlook profiles, mobile devices)
- External sharing links and calendar invitations
Microsoft Cross-Tenant Migration Tool
Microsoft's native Cross-Tenant Migration tool handles mailbox and OneDrive migration without third-party software. It moves data within Microsoft's internal network, which means faster throughput, preserved metadata, and no data exfiltration to external servers.
What It Migrates
- Exchange Online mailboxes (email, calendar, contacts)
- OneDrive for Business files and folder structure
- Mailbox permissions (delegate, send-as, send-on-behalf)
- File sharing links and permissions (OneDrive)
- Mailbox rules and auto-replies
What It Does Not Migrate
- SharePoint Online site collections
- Teams channels, chats, and channel files
- Power BI workspaces and reports
- Power Automate flows and Power Apps
- 1:1 and group chat history (Teams)
Configuration Prerequisites: Cross-tenant migration requires: Organization Relationship configured in both tenants, Migration Endpoint created in the target tenant, MailUser objects pre-created in the target tenant with ExchangeGUID and ArchiveGUID attributes matching the source mailbox, and the ApplicationId permission granted to the migration app in both tenants. EPC Group automates this setup using PowerShell scripts that configure both tenants in under 2 hours.
Identity Management: Entra ID Cross-Tenant
Identity is the foundation of every tenant migration. Users must exist in the target tenant before their data can be moved, and their attributes must match precisely for the cross-tenant migration tool to link source and target objects.
User Object Creation
Create MailUser objects in the target tenant for every user being migrated. These objects must have the ExchangeGUID, ArchiveGUID (if archive mailbox exists), and all email aliases (proxyAddresses) matching the source mailbox. EPC Group exports these attributes from the source tenant using PowerShell and bulk-creates target objects using Microsoft Graph API.
UPN and Email Address Management
During coexistence, users may need temporary UPNs (user@targetcompany.onmicrosoft.com) until the vanity domain is transferred. After DNS cutover, UPNs and primary email addresses are updated to the vanity domain. This change requires Outlook profile reconfiguration and mobile device re-enrollment on affected devices.
MFA Re-Enrollment
MFA registrations are tenant-specific and cannot be migrated. Every user must re-register their MFA methods (Authenticator app, phone number, FIDO2 key) in the target tenant. This is the most user-impacting step of the migration. EPC Group provides step-by-step guides and schedules MFA enrollment sessions for each migration batch.
Group and Role Migration
Security groups, Microsoft 365 groups, distribution lists, and admin role assignments must be recreated in the target tenant. Groups cannot be migrated — they must be created fresh with matching membership. EPC Group uses PowerShell to export group membership from the source and recreate groups with identical members in the target.
Conditional Access Policies
Conditional access policies (MFA requirements, location-based access, device compliance) must be recreated in the target tenant. Policies reference tenant-specific objects (group IDs, named locations, terms of use) that differ between tenants. EPC Group documents all source policies, maps object references to target equivalents, and recreates policies before user migration begins.
5-Phase Migration Methodology
EPC Group's proven approach for enterprise tenant-to-tenant migration.
Discovery & Planning
2-4 weeks
- Inventory source tenant: users, mailboxes, groups, SharePoint sites, Teams, Power BI workspaces
- Map data ownership — identify which users and data are in scope for migration
- Assess data volumes: total mailbox size, OneDrive storage, SharePoint site collections
- Document custom configurations: conditional access, DLP policies, retention labels, sensitivity labels
- Identify third-party integrations connected to the source tenant (SSO, API connections)
- Define coexistence requirements: mail flow, calendar sharing, GAL sync duration
- Create detailed migration schedule with batch assignments and cutover windows
Target Tenant Preparation
2-3 weeks
- Provision target tenant with required Microsoft 365 licenses (E3/E5, add-ons)
- Configure Entra ID: create mail-enabled user objects with matching attributes from source
- Set up cross-tenant organization relationships for mailbox and OneDrive migration
- Recreate conditional access policies, DLP rules, and retention policies in target tenant
- Configure mail flow connectors for coexistence between source and target tenants
- Deploy GAL sync tool (CodeTwo, Binary Tree) for address book coexistence
- Test cross-tenant migration with a pilot batch of 10-25 users
Data Migration (Phased)
4-12 weeks
- Migrate mailboxes in batches of 200-500 users using cross-tenant migration tool
- Migrate OneDrive content in parallel with mailbox moves
- Migrate SharePoint sites using ShareGate or AvePoint — prioritize high-impact sites
- Migrate Teams channels and files using third-party tools (AvePoint Fly, ShareGate)
- Execute incremental syncs to capture changes made during migration window
- Validate each batch: verify mailbox content, OneDrive files, and SharePoint permissions
- Communicate to each batch of users before, during, and after their migration window
DNS Cutover & Domain Transfer
1-2 weeks
- Lower DNS TTL to 300 seconds one week before cutover
- Remove vanity domain from source tenant (requires all users migrated first)
- Add and verify domain in target tenant via DNS TXT record
- Update MX, autodiscover, SPF, DKIM, and DMARC DNS records for target tenant
- Monitor mail flow for 48-72 hours to confirm delivery to target tenant
- Update UPNs and email addresses in target tenant to use the vanity domain
- Reconfigure Outlook profiles and mobile devices for affected users
Decommission & Optimization
2-4 weeks
- Verify all users, mailboxes, and data are accessible in target tenant
- Consolidate licensing — transfer or cancel source tenant subscriptions
- Remove GAL sync and coexistence connectors
- Archive or delete data in source tenant per retention requirements
- Cancel source tenant subscription after retention period
- Conduct post-migration review: document lessons learned and outstanding items
- Optimize target tenant: right-size licensing, clean up duplicate groups, enforce governance
Timeline by Organization Size
| Organization Size | Mailbox Migration | SharePoint | Teams | Total Duration |
|---|---|---|---|---|
| Small (100-500 users) | 4-6 weeks | 2-3 weeks | 1-2 weeks | 6-10 weeks |
| Mid-Size (500-5,000 users) | 6-10 weeks | 4-8 weeks | 2-4 weeks | 12-20 weeks |
| Enterprise (5,000-20,000 users) | 10-16 weeks | 8-16 weeks | 4-8 weeks | 5-8 months |
| Large Enterprise (20,000+ users) | 16-24 weeks | 12-24 weeks | 6-12 weeks | 7-12 months |
Throttling Reality: Microsoft throttles cross-tenant migration to approximately 500 mailboxes per batch and 2-5 GB per hour per mailbox. A 10,000-user organization with 5 GB average mailbox size requires approximately 20 migration batches running over 8-10 weeks. EPC Group accounts for throttling limits in every migration schedule and runs batches during off-peak hours to maximize throughput.
Coexistence Period: Keeping Both Tenants Working
During the migration window, users exist in both tenants. Some have already migrated to the target; others remain in the source. The coexistence configuration ensures seamless communication between both groups — email delivery, calendar sharing, and address book lookups must work regardless of which tenant a user currently resides in.
Mail Flow Connectors
Send and receive connectors configured in both Exchange Online tenants route email correctly between migrated and non-migrated users. Mail-enabled contacts in each tenant represent users in the other tenant, ensuring delivery to the correct mailbox.
GAL (Address Book) Sync
Third-party tools (CodeTwo, Binary Tree, Quest) synchronize the Global Address List between tenants so users can find and email colleagues regardless of which tenant they are in. GAL sync runs every 15-30 minutes to keep address books current.
Calendar Free/Busy Sharing
Organization relationships configured in Exchange Online allow users in both tenants to view each other's calendar availability (free/busy). This preserves the ability to schedule meetings across tenants during the migration window.
Shared Resource Coexistence
Shared mailboxes, conference rooms, and distribution groups accessed by users in both tenants require mail-enabled contacts and forwarding rules to ensure messages reach the correct destination during the transition.
Frequently Asked Questions
How do you migrate between Microsoft 365 tenants?
Tenant-to-tenant migration involves moving users, mailboxes, OneDrive files, SharePoint sites, Teams data, and identity objects from one Microsoft 365 tenant to another. The process uses Microsoft's native Cross-Tenant Migration tool (for mailboxes and OneDrive) combined with third-party tools for SharePoint sites and Teams channels. The high-level steps are: 1) Establish cross-tenant trust between source and target tenants using Azure AD organization relationships. 2) Prepare the target tenant with licensing, domains, and identity matching. 3) Migrate mailboxes using cross-tenant mailbox migration (Exchange Online). 4) Migrate OneDrive content using cross-tenant OneDrive migration. 5) Migrate SharePoint sites using ShareGate, AvePoint, or Microsoft Mover. 6) Migrate Teams using third-party tools (AvePoint, ShareGate, BitTitan). 7) Execute DNS cutover to redirect mail flow to the target tenant. 8) Decommission the source tenant. EPC Group has executed tenant-to-tenant migrations for organizations with 500 to 50,000+ users across M&A, divestitures, and rebranding scenarios.
What is the Microsoft Cross-Tenant Migration tool?
The Cross-Tenant Migration tool is Microsoft's native capability for moving Exchange Online mailboxes and OneDrive for Business data between tenants without requiring third-party tools. It was introduced in 2022 and is now the recommended approach for mailbox and OneDrive migration in M&A scenarios. The tool requires: cross-tenant organization relationships configured in both source and target tenants, Azure AD mail-enabled users created in the target tenant before migration, and migration batches configured through Exchange Online PowerShell or the Exchange Admin Center. Key advantages: mailboxes move as a native move request (faster than IMAP or PST-based migration), OneDrive data moves with permissions and sharing links preserved, and the migration uses Microsoft's internal network — no data leaves the Microsoft 365 infrastructure. Limitations: it does not migrate SharePoint sites, Teams channels, or Planner data — those require third-party tools.
How long does a tenant-to-tenant migration take?
Migration timeline depends on user count, data volume, and complexity: Small organization (100-500 users, email + OneDrive only): 4-8 weeks. Mid-size organization (500-5,000 users, full workload migration): 8-16 weeks. Enterprise organization (5,000-50,000+ users, complex SharePoint, Teams, Power BI): 4-9 months with phased cutover. Key timeline factors: identity preparation and matching (2-4 weeks), mailbox migration throughput (Microsoft throttles to approximately 500 mailboxes per batch, 2-5 GB/hour per mailbox), OneDrive migration (limited by file count more than total size — millions of small files take longer than fewer large files), SharePoint site migration (1-10 TB per day depending on tool and throttling), coexistence period (4-8 weeks recommended for mail flow, calendar sharing, and GAL sync), and DNS cutover and domain transfer (24-72 hours for propagation). EPC Group manages the entire timeline with detailed project plans that account for Microsoft throttling limits and weekend cutover windows.
How do you handle identity and Entra ID during tenant migration?
Identity management is the most complex aspect of tenant-to-tenant migration. Each user exists as a unique object in the source tenant's Entra ID (Azure AD) and must be recreated or matched in the target tenant. The process involves: 1) Export user attributes from the source tenant (UPN, email aliases, group memberships, licenses, MFA settings, conditional access assignments). 2) Create mail-enabled users in the target tenant with matching attributes — these are placeholder objects that become full users after mailbox migration. 3) For hybrid environments with on-premises AD, synchronize the target tenant with the appropriate on-premises AD forest using Entra Connect. 4) Handle UPN changes — if the target tenant uses a different domain, users get new UPNs (e.g., user@sourcecompany.com becomes user@targetcompany.com). 5) Re-enroll MFA — users must re-register their MFA methods in the target tenant (this is the most disruptive step for end users). 6) Migrate conditional access policies — recreate policies in the target tenant, as they cannot be exported/imported natively. EPC Group uses PowerShell automation to export and recreate identity configurations, reducing manual effort by 80%.
Can you migrate Teams channels and chat history between tenants?
Teams migration between tenants is the most challenging workload because Teams data is distributed across multiple backend services: channel messages in Exchange Online group mailboxes, files in SharePoint Online sites, OneNote notebooks, Planner tasks, and Wiki pages. Microsoft does not provide a native cross-tenant Teams migration tool. Third-party solutions from AvePoint (Fly), ShareGate, and BitTitan (MigrationWiz) can migrate Teams channels, files, and channel message history. However, 1:1 chat history and group chat history cannot be migrated — this is a hard limitation of the Teams architecture. Workarounds include: exporting chat history to HTML/PDF using eDiscovery or Teams export API before migration, and communicating to users that private chat history will not transfer. For channel data, third-party tools migrate channel messages, tabs, files, and membership. EPC Group recommends a phased approach: migrate critical Teams with full channel history, archive low-activity Teams in the source tenant, and create new Teams in the target tenant where a fresh start is acceptable.
How do you handle mail flow coexistence during migration?
During migration, users exist in both tenants simultaneously — some already migrated, some still in the source. Mail flow coexistence ensures email delivery works correctly regardless of which tenant a user currently resides in. The coexistence configuration includes: 1) Cross-tenant mail flow connectors — configure send/receive connectors in both Exchange Online tenants so mail routes correctly between migrated and non-migrated users. 2) GAL (Global Address List) sync — use a third-party tool (CodeTwo, Binary Tree, Quest) to synchronize the address book between tenants so users can find and email colleagues in the other tenant. 3) Free/busy (calendar) sharing — configure organization relationships in Exchange Online to allow calendar availability lookups across tenants. 4) Shared mailbox and distribution group coexistence — maintain mail-enabled contacts in both tenants for shared resources until all users are migrated. The coexistence period typically lasts 4-8 weeks for organizations migrating in phases. EPC Group configures and tests coexistence before the first user migrates to ensure zero mail flow disruption.
How does DNS cutover work in a tenant migration?
DNS cutover is the final step that redirects all email, autodiscover, and authentication traffic from the source tenant to the target tenant. The process: 1) Remove the vanity domain (e.g., company.com) from the source tenant — this requires all mailboxes using that domain to already be migrated and all references to the domain removed from UPNs and email aliases. 2) Add the domain to the target tenant and verify ownership via DNS TXT record. 3) Update DNS MX records to point to the target tenant's Exchange Online endpoints. 4) Update autodiscover CNAME to point to autodiscover.outlook.com for the target tenant. 5) Update SPF, DKIM, and DMARC records for the target tenant. The total DNS propagation takes 24-72 hours. During this window, email may be delivered to either tenant depending on DNS caching. EPC Group schedules DNS cutovers for Friday evenings, allowing a full weekend for propagation before Monday morning business hours. We lower DNS TTL values to 300 seconds one week before cutover to accelerate propagation.
What happens to SharePoint sites and OneDrive during migration?
OneDrive migration uses the native Cross-Tenant Migration tool: each user's OneDrive content is moved to the target tenant with folder structure, file versions, and sharing links preserved. The migration runs in the background and users retain access to their files throughout. SharePoint site migration is more complex because sites often have custom permissions, workflows, Power Automate flows, and Power Apps connected to them. SharePoint migration options: 1) Microsoft's Cross-Tenant SharePoint Migration (preview in 2026) — native migration for sites with content, permissions, and metadata. 2) ShareGate — the most popular third-party tool, supports full-fidelity migration with permissions, metadata, and version history. 3) AvePoint — enterprise-grade migration with pre-migration assessment, incremental sync, and rollback capability. Key challenges: SharePoint lists with complex column types, Power Automate flows connected to SharePoint (must be recreated), Power Apps embedding SharePoint data sources (must be repointed), and custom SharePoint Framework (SPFx) solutions deployed to the source tenant. EPC Group migrates SharePoint with a site-by-site approach, prioritizing high-business-impact sites and archiving inactive sites.
How do you consolidate licensing after a tenant merge?
Licensing consolidation after M&A migration involves: 1) Audit current licensing in both tenants — identify SKUs, quantities, and expiration dates using the Microsoft 365 Admin Center or PowerShell (Get-MgSubscribedSku). 2) Determine the target licensing model — typically the acquiring company's EA (Enterprise Agreement) or MCA (Microsoft Customer Agreement) absorbs the acquired company's licenses. 3) Contact Microsoft account team or LSP (Licensing Solutions Provider) to initiate license transfer — Microsoft provides a formal process for transferring subscriptions between tenants during M&A. 4) Address license true-up — the target tenant may need additional licenses if the acquired organization has higher license tiers or add-ons. 5) Remove duplicate licenses — after migration, users may temporarily have licenses in both tenants. Deprovision source tenant licenses after the decommission window. 6) Optimize licensing — M&A is the ideal time to right-size licensing (e.g., moving E5 users who only need E3 features to E3 + specific add-ons). EPC Group works with Microsoft licensing specialists to ensure license transfer complies with Microsoft's commercial terms and avoids double-billing during the transition period.
Plan Your Tenant-to-Tenant Migration
Start with a Tenant Migration Assessment. EPC Group inventories both tenants, identifies data in scope, designs the coexistence architecture, and delivers a phased migration plan with timeline, licensing analysis, and risk mitigation strategy. Fixed-fee assessment starting at $20,000.