Multi-Tenant Microsoft 365 Consolidation: Merging Tenants Without Breaking Anything

Why Organizations Consolidate Tenants

Multi-tenant environments create operational friction that compounds over time. Users cannot search the global address list across tenants. Teams collaboration requires guest accounts and external sharing. SharePoint content is siloed with separate search indexes. Security policies must be maintained independently in each tenant. And licensing costs multiply because each tenant requires its own subscriptions.

Common scenarios driving consolidation include post-merger integration where acquired companies bring their own Microsoft 365 tenants, organizations that created separate tenants for different business units or regions, companies that inherited multiple tenants from historical IT decisions, and divestitures where a business unit needs to be separated from a parent tenant.

At EPC Group, we have consolidated as many as seven Microsoft 365 tenants into a single environment for organizations ranging from 200 to 15,000 users. Our methodology addresses every workload and interdependency to ensure zero data loss and minimal user disruption.

Tenant-to-Tenant Migration Tools: Native vs. Third-Party

The migration tooling decision significantly impacts timeline, cost, and data fidelity. Each approach has specific strengths and limitations.

Microsoft Cross-Tenant Migration (Native)

Microsoft's native cross-tenant mailbox migration, released in 2023, provides direct tenant-to-tenant mailbox migration without requiring PST export/import or third-party tools. Key capabilities and limitations include:

• Supported workloads: Exchange Online mailbox migration (primary mailbox and archive), including calendar, contacts, rules, and mail flow settings. OneDrive for Business migration is supported in preview.
• Prerequisites: Both tenants must have Azure AD/Entra ID configured with a cross-tenant migration relationship. The target tenant must have available licenses. Organization relationships must be established for mail flow during coexistence.
• Limitations: Does not migrate Teams data (chat history, channel messages), SharePoint sites, Power Platform apps, or Intune device configurations. SharePoint and Teams migration requires separate tooling.
• Best for: Organizations with primarily Exchange Online workloads and minimal SharePoint/Teams complexity. The native tool eliminates third-party licensing costs and provides direct Microsoft support.

BitTitan MigrationWiz

ShareGate

Identity Merge with Microsoft Entra ID

Identity consolidation is the most critical and complex phase of tenant merging. Every user, group, application registration, and device must be migrated to the target tenant's Entra ID directory.

User Identity Migration

• UPN alignment: Users in the source tenant must be assigned UPNs matching the target tenant's domain structure. If source users are john@contoso.com and target is @fabrikam.com, decide whether to maintain contoso.com as a secondary domain in the target or rebrand all users to fabrikam.com UPNs.
• Password synchronization: User passwords cannot be directly migrated between tenants. Options include forced password reset at first sign-in (disruptive), temporary password with self-service password reset, or federated authentication through a common IdP that spans both tenants during transition.
• MFA re-enrollment: MFA registrations (authenticator app, phone numbers, FIDO2 keys) do not transfer between tenants. Users must re-register MFA methods in the target tenant. Plan for a self-service re-enrollment period with temporary MFA exceptions for the cutover window.
• Group and role migration: Security groups, Microsoft 365 groups, distribution lists, and administrative roles must be recreated in the target tenant. Map source groups to target groups, preserving membership and nesting. Dynamic group rules need re-creation and testing.

Application Registration Migration

Entra ID application registrations (enterprise apps, app registrations, service principals) are tenant-specific. Every application that uses Microsoft identity platform authentication must be re-registered in the target tenant. This includes line-of-business applications, third-party SaaS integrations using SSO, Power Platform solutions, and custom APIs. Inventory all app registrations, document client IDs, redirect URIs, API permissions, and certificate/secret configurations for recreation.

Domain Transfer Sequence

Custom domains (contoso.com, fabrikam.com) can only exist in one Microsoft 365 tenant at a time. Domain transfer requires a precise sequence to avoid mail flow disruption.

1. Prepare source tenant: Change all user UPNs from @contoso.com to @contoso.onmicrosoft.com (the default tenant domain). Update all email addresses, group aliases, and shared mailbox addresses that use the custom domain. This is the most time-consuming step for large organizations.
2. Remove domain from source: Once no objects reference the custom domain, remove it from the source tenant in Microsoft 365 admin center. The domain enters a release period.
3. Wait for propagation: Domain release can take up to 24 hours to propagate across Microsoft's infrastructure. Attempting to add the domain to the target tenant too soon will fail with a "domain already in use" error.
4. Add domain to target tenant: Add the custom domain to the target tenant and verify ownership via DNS TXT record. Once verified, configure the domain as the primary domain for migrated users.
5. Update user identities: Change migrated user UPNs and email addresses to the custom domain in the target tenant. Update Exchange Online email address policies to assign the correct domain.
6. Update DNS records: Update MX, autodiscover, SPF, DKIM, and DMARC records to point to the target tenant. Pre-lower DNS TTL to 300 seconds at least 48 hours before this step.

Teams Data Migration: The Hardest Workload

Microsoft Teams migration is the most challenging workload in tenant consolidation because Teams data spans multiple backend services including Exchange Online (chat messages), SharePoint Online (channel files), Azure (compliance data), and Stream (meeting recordings).

What Can Be Migrated

• Team structure and channels: Recreate Teams and channels in the target tenant using PowerShell or Graph API. Channel descriptions, tabs, and settings must be documented and recreated manually or via script.
• Channel files: Files in Teams channels are stored in SharePoint document libraries. Migrate these using ShareGate or SharePoint Migration Tool with full metadata and version history preservation.
• Tabs and connectors: Tabs (Planner, OneNote, SharePoint, website) must be reconfigured in the target tenant. Custom connectors and webhooks need re-registration. Power Automate flows connected to Teams channels require migration and reconnection.

What Cannot Be Directly Migrated

• 1:1 and group chat history: Personal chat messages are stored in user mailboxes and can be migrated with cross-tenant mailbox migration, but they appear in the migrated mailbox rather than in the Teams chat interface. True chat history migration with Teams UI preservation is not currently supported.
• Channel message history: Channel conversations (messages, replies, reactions) cannot be natively migrated. Third-party tools can export channel history to HTML/PDF for archival, but importing into the target Teams channel is not supported. The target channels start with a fresh conversation history.
• Meeting recordings and transcripts: Stream-based recordings are tied to the source tenant. Export recordings and re-upload to the target tenant's Stream or SharePoint. Transcripts must be re-associated manually.

SharePoint Site Remapping Strategy

SharePoint sites in the source tenant (contoso.sharepoint.com) must be migrated to the target tenant (fabrikam.sharepoint.com). This changes every site URL, which impacts bookmarks, application integrations, Power Automate flows, and Power BI data connections.

• URL mapping document: Create a comprehensive mapping of every source site URL to its target URL. Include subsites, document libraries, lists, and individual files referenced by external systems.
• Migration tool selection: Use ShareGate for complex sites with custom columns, content types, workflows, and extensive permissions. Use SharePoint Migration Tool (SPMT) for simpler sites with standard document libraries.
• Permission remapping: SharePoint permissions reference source tenant identities. During migration, map source users and groups to target tenant identities. ShareGate and SPMT both support permission mapping via CSV files.
• Search re-indexing: After migration, SharePoint search indexes need time to crawl and index migrated content. Full index population can take 24-72 hours for large migrations. Communicate this delay to users to set expectations.
• Redirect configuration: Configure HTTP 301 redirects or SharePoint site redirect pages on the source tenant to point users to new URLs during the transition period.

Phased Approach: How to Sequence the Migration

Tenant consolidation must follow a deliberate sequence to manage dependencies and minimize risk. EPC Group's phased approach has been refined over dozens of consolidation projects.

1. Phase 1: Coexistence setup — Establish cross-tenant trust, configure mail flow coexistence, enable calendar federation, set up guest access for cross-tenant collaboration during migration.
2. Phase 2: Identity migration — Provision user accounts in target tenant, configure hybrid identity if needed, prepare group and role mappings, set up conditional access policies.
3. Phase 3: Mailbox migration — Migrate Exchange mailboxes in batches (50-100 users per batch), starting with the pilot group. Validate mail flow, calendar sharing, and resource booking after each batch.
4. Phase 4: OneDrive migration — Migrate personal OneDrive content. Run in parallel with mailbox migration batches. Validate file access, sharing links, and sync client reconnection.
5. Phase 5: SharePoint migration — Migrate SharePoint sites by priority (most-used sites first). Validate permissions, search, and application integrations after each site migration.
6. Phase 6: Teams recreation — Recreate Teams structure in target tenant, migrate channel files, reconfigure tabs and connectors. Archive source Teams channel history for reference.
7. Phase 7: Domain transfer and cutover — Execute domain transfers during maintenance windows. Update DNS records. Validate mail flow and authentication for all migrated users.
8. Phase 8: Decommission source tenant — After 30-90 day validation period, decommission source tenant. Archive any remaining data per retention requirements. Cancel source tenant licenses.

Partner with EPC Group for Tenant Consolidation

Tenant-to-tenant migration is one of the most complex Microsoft 365 projects an organization can undertake. EPC Group has led multi-tenant consolidation projects for organizations across healthcare, financial services, manufacturing, and professional services. With 25+ years of Microsoft migration expertise and bestselling author Errin O'Connor leading our practice, we deliver consolidation projects that merge tenants without breaking the collaboration, communication, and compliance systems your organization depends on.