When tenant-to-tenant migration is required
Three scenarios trigger the work. Each has a different organizational driver and a different set of constraints — and each requires a different approach to planning and execution.
Mergers & Acquisitions
Two organizations combine into a single Microsoft 365 tenant for unified identity, consolidated licensing, and seamless collaboration. The acquiring tenant is usually the target. Often constrained by deal timelines and Transitional Service Agreement (TSA) deadlines.
Divestitures & Spin-offs
A business unit is sold and must be cleanly separated from the parent tenant. Requires legal-grade data separation of IP and customer data, plus a long coexistence period governed by the TSA. The parent retains everything that belongs to the continuing entity.
Rebranding & Restructuring
Domain namespace changes significantly, or the organization wants to escape years of legacy configuration, policies, and technical debt. Also triggered when a regulated subsidiary needs independence from a parent company.
The six workstreams
A tenant migration is six coordinated workstreams running on overlapping timelines. Identity is the foundation — every other workload depends on it being right.
Identity & Entra ID
UPN, proxy address, and group-name conflicts must be resolved before any workload migration starts.
- Inventory every user, shared mailbox, room/resource, service account, and guest in both directories
- Map group memberships, custom attributes, conditional-access policies, and app registrations
- Detect UPN, proxy address, group-name, and attribute conflicts (EPC Group ships a conflict-resolution report in week 2)
- Configure cross-tenant synchronization for coexistence-period external member access
- Multi-forest AD: rebuild Azure AD Connect / Cloud Sync with conflict rules, OU filters, and attribute mapping
Exchange Online Mailboxes
Cross-tenant mailbox migration preserves mail, calendar, contacts, tasks, notes, and folder structure.
- 8–15 migration batches over 4–8 weeks for a 10K-user org
- Group by department to keep collaborating teams together
- Balance batches by mailbox size — 50GB+ users skew throughput
- VIPs get white-glove migration with same-day validation
- Shared and resource mailboxes ready in target tenant before user migration
- Litigation hold and eDiscovery state preserved across the move
SharePoint + OneDrive
Largest data volume in most migrations. SPMT, ShareGate, and AvePoint each cover different gaps.
- Inventory site collections, owners, last activity, custom SPFx solutions
- Recreate managed metadata term stores and content type hubs in target tenant FIRST
- Redeploy custom SPFx apps and rewrite tenant-specific endpoints
- Recreate Power Automate workflows and reconnect to migrated content
- Map source-tenant identities to target-tenant identities for site permissions
- Maintain external sharing configs and retention labels post-migration
Microsoft Teams
The most complex workload — Teams is an integration layer over Exchange, SharePoint, and OneDrive.
- Migrate team structures + channel configs via Microsoft Graph API or third-party tools
- Channel files ride along with the underlying SharePoint site migration
- Accept 1:1 and group chat history limitations — archive for compliance, do not promise migration
- Recreate Teams apps, tabs, and connectors per team in target tenant
- Migrate Teams Phone: call queues, auto-attendants, calling policies, number assignments
- Re-establish meeting policies, compliance recording, and guest access policies
Intune & Endpoint Management
Intune configurations do not transfer between tenants. Everything is rebuilt from export.
- Device compliance policies
- Device configuration profiles
- App protection policies for BYOD
- Conditional access integrated with Entra ID
- Windows Autopilot deployment profiles
- LOB + standard application deployment packages
- Device re-enrollment is the most disruptive end-user event — sequence after identity + mailbox migrate
Domain Transfer + DNS Cutover
A custom domain can only exist in one Microsoft 365 tenant at a time. 4–12 hour window.
- Update every UPN, proxy address, group, and app registration off the source domain first
- Remove custom domain from source tenant once all references are cleared
- Add and verify domain in target tenant (DNS TXT record)
- Update MX, SPF, DKIM, and DMARC for the target tenant
- Lower DNS TTL to 5 minutes 48 hours before cutover
- Execute cutover during weekend low-volume window with bidirectional mail forwarding as safety net
Coexistence: keeping the business running
For 2–4 months users live in both tenants. Six coexistence configurations are non-negotiable for any enterprise-scale migration.
Mail flow coexistence
Bidirectional transport rules route mail between tenants regardless of current mailbox location. Updated as each batch completes.
Free/busy coexistence
Organization relationships enable calendar free/busy sharing across the migration boundary — meetings work regardless of host tenant.
Teams federation
Cross-tenant access policies enable Teams chat and meetings between source and target users in real time throughout the migration.
SharePoint access
Cross-tenant sync + B2B guest access keep shared sites and document libraries accessible during the migration period.
Application access
Conditional access policies in both tenants accommodate users authenticating from either tenant without triggering false-positive security alerts.
Global Address List
GAL synchronization keeps users in both tenants findable in the address book — the user-facing experience stays seamless.
Timeline by user scale
Planning numbers from EPC Group's tenant migration engagements. Real durations depend on hybrid Exchange, custom SharePoint, multi-forest AD, and regulatory complexity.
| Phase | 5K Users | 15K Users | 50K Users |
|---|---|---|---|
| Discovery & Planning | 3–4 weeks | 4–6 weeks | 6–8 weeks |
| Identity Preparation | 2–3 weeks | 3–4 weeks | 4–6 weeks |
| Mailbox Migration | 3–4 weeks | 6–8 weeks | 10–14 weeks |
| SharePoint / OneDrive | 3–5 weeks | 5–8 weeks | 8–12 weeks |
| Teams Migration | 2–3 weeks | 3–4 weeks | 4–6 weeks |
| Intune Re-enrollment | 2–3 weeks | 3–4 weeks | 4–6 weeks |
| DNS Cutover | 1 week | 1–2 weeks | 2–3 weeks |
| Post-Migration | 2–3 weeks | 3–4 weeks | 4–6 weeks |
| Total | 4–6 months | 6–9 months | 9–14 months |
The five failure modes — and how to avoid them
Tenant migrations fail for predictable reasons. Each of these is a real incident from the EPC Group portfolio, and each has a mitigation pattern that works.
Email disruption during domain cutover
Mitigation: Reduce DNS TTL 48 hours ahead, bidirectional mail forwarding, lowest-volume cutover window, monitor DNS propagation globally before declaring complete.
Data loss during SharePoint migration
Mitigation: Pre-migration validation scans comparing source/target inventories, incremental sync to capture in-flight changes, source kept read-only until target validated.
Identity conflicts causing auth failures
Mitigation: Comprehensive directory assessment up front, automated conflict detection tooling, staged approach resolving all conflicts in a test batch first.
Third-party application breakage
Mitigation: Full app inventory, vendor coordination on tenant-change procedures, pilot-phase connectivity testing, rollback plan for critical applications.
User productivity loss from poor communication
Mitigation: Department-specific communication plans, pre-migration training, migration-day cheat sheets, augmented help desk staffing per batch.
Partner with EPC Group for tenant-to-tenant migration
EPC Group has delivered tenant-to-tenant migrations for organizations from 2,000 to 75,000 users — across healthcare, financial services, government, and technology. The methodology is refined from many M&A integrations and divestitures, with zero data loss and minimal business disruption.
Our Microsoft 365 consulting practice covers pre-acquisition IT due diligence, migration planning and architecture, execution with dedicated migration engineers and 24/7 cutover support, coexistence management, user communication and training, and post-migration optimization with source-tenant decommissioning.
Frequently asked questions
The five questions enterprise IT teams ask before signing the SOW.
How long does a tenant-to-tenant migration take for a 10,000-user organization?
What is the cost of a tenant-to-tenant migration per user?
Can you migrate Microsoft Teams channels and chat history between tenants?
What happens to email during a tenant-to-tenant migration?
Do you need to relicense users during a tenant-to-tenant migration?
Errin O'Connor
CEO & Chief AI Architect at EPC Group
29 years in enterprise technology consulting. Microsoft Press bestselling author of four books on large-scale migrations. Has led tenant-to-tenant migrations for organizations up to 75,000 users across healthcare, financial services, government, and technology.