Skip to main content

EPC Group delivers carve-out Microsoft 365 tenant migrations for divested business units. TSA exit, identity de-provisioning, content separation, and full standalone tenant standup in 60-120 days. We rebuild the regulatory baseline (HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP) in the destination tenant before content lands. Cutover execution averages 5 days.

Key Facts

  • Four-phase carve-out playbook (Separate, Isolate, Cutover, Stabilize) compresses standalone tenant standup into 60-120 days.
  • 5-day average cutover execution window — same as broader M&A practice.
  • Pre-close diligence support available 30-45 days before close for compressed timelines.
  • Mid-market and enterprise carve-outs are fixed-fee, scoped after discovery.
  • Post-carve-out Managed Microsoft Cloud retainers are priced after a scoping call.
  • Sub-practice of EPC Group M&A practice (216+ migrations, 1.83M+ users moved 2023-2025).
Carve-Out and Divestiture Microsoft 365 Tenant Migration Practice

Carve-Out Microsoft 365 Tenant Migration: TSA Exit, Clean Separation, Day-1 Independence

Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group

Standalone Microsoft 365 tenant standup for divested business units. Identity de-provisioning, content separation, regulatory baseline maintained, TSA exit in 60-120 days.

Carve-out engagements are a sub-practice of EPC Group's M&A Microsoft 365 tenant migration practice. Across 216+ M&A engagements completed between 2023 and 2025, carve-outs and divestitures represent a significant share of the work. The four-phase carve-out playbook compresses standalone tenant standup into a 60-120 day execution window with a 5-day cutover average.

216+
M&A tenant migrations (2023-2025)
1.83M+
Users migrated across M&A engagements
78,000
Largest single M&A tenant migration
5-day
Average cutover execution window
14+
M&A advisory firm engagements
45+
PE-backed portfolio integrations

Why Carve-Out Migrations Are Different From Standard M&A Migrations

A standard M&A migration consolidates two or more source tenants into one destination tenant. A carve-out goes the other direction: it pulls a business unit out of an existing parent tenant and builds a complete standalone Microsoft 365 environment for it. The destination tenant doesn't exist on Day 1 of the engagement — it has to be built from scratch while the source tenant remains operational.

Transition Services Agreements (TSAs) typically grant 60-180 days of continued access to the parent tenant after deal close. TSA expiration is a contractual deadline, not a target. If the standalone tenant isn't ready on TSA exit day, the divested entity loses access to its own users, email, files, and collaboration tools. There is no extension by default.

The EPC Group carve-out playbook is built around this constraint — four compressed phases (Separate, Isolate, Cutover, Stabilize) with parallel workstreams, pre-close diligence support, and TSA Exit Confirmation as the contractual deliverable.

Plan backwards from the TSA end date. Download the sample TSA-exit critical-path plan (CSV): one row per workload (identity, licenses, custom domains, mailboxes, OneDrive, SharePoint and Teams, Power Platform, devices, retention and legal holds, single sign-on apps), with its dependency on the parent tenant, the milestone that ends it, what it depends on, whether the step can be reversed and a deadline counted back from TSA end. One-way steps such as moving a custom domain, which is verified in only one tenant at a time, go through the cutover and rollback checklist. The rows are a sample plan, not client data.

Workload acceptance criteria before TSA exit

TSA exit is signed off workload by workload. Each row has a test that must pass in the destination tenant, and a constraint that applies while the parent and destination tenants run side by side. Which rows apply depends on the deal's carve-out scope.

WorkloadAcceptance test before TSA exitCoexistence constraint during the TSA
Identity (Entra ID)Every in-scope user signs in to the destination tenant with MFA and the Conditional Access baseline applies; no in-scope account still authenticates against the parentCross-tenant access settings or B2B guest access for shared work until cutover
Mail (Exchange Online)MX and Autodiscover point to the destination; mailbox item counts reconcile with the source for a sample of users; journaling and retention rules are in placeCross-tenant free/busy through an organization relationship while both tenants run
SharePoint and OneDriveItem counts and permissions reconcile for every extracted site and OneDrive; sharing links are rebuilt; no in-scope content is left in the parentB2B sharing for content still being split; extraction scope frozen before the final delta
TeamsTeams, channels and their files are in the destination; how chat history is handled (migrated with a tool or exported) is agreed before cutoverExternal access between the two tenants for meetings and chat during the transition
Power PlatformIn-scope environments, apps and flows are moved or rebuilt, connections re-authenticated and DLP policies applied; no flow still runs under a parent accountParent-owned connectors and data sources listed with an owner and an end date
Endpoint management (Intune)Devices are enrolled in the destination Intune and compliance policies apply; devices cannot move between tenants, so this means re-enrollment or resetParent device management stays until each device re-enrolls; the schedule follows the user waves

Exit gate: parent access is revoked on an agreed date only after every in-scope workload passes. The same gate logic for the buyer side is in the M&A Day-1 five-gate model, and the separation sequence is in the divestiture and carve-out runbook.

The Carve-Out Microsoft 365 Migration Playbook

A four-phase methodology optimized for TSA exit deadlines.

1

Separate

Weeks 1-2

Source-tenant inventory of carve-out scope. Identity isolation plan. Content extraction plan. TSA scope and exit milestones documented. Pre-close diligence support where the deal team needs visibility before close.

Named Artifacts

Carve-Out Scope DefinitionTSA Exit PlanIdentity Isolation Plan
2

Isolate

Weeks 3-6

New destination tenant standup. Identity de-provisioning from parent. Content extraction. Regulatory baseline re-established in the new tenant. Microsoft Purview labels, Conditional Access, and DLP policies rebuilt from carve-out scope.

Named Artifacts

Destination Tenant Build RecordContent Extraction ReportCompliance Baseline (New Tenant)
3

Cutover

5-day average execution window

Identity transition. Email and collaboration cutover. SharePoint, OneDrive, and Microsoft Teams content live in destination tenant. End-user enablement. Hypercare period begins immediately.

Named Artifacts

Cutover Execution PlanGo-Live Readiness AssessmentEnd-User Enablement
4

Stabilize

Weeks 7-12

Hypercare with daily reporting for the first 14 days. TSA exit confirmation. Defect closure. Adoption measurement. Optional continuation under a Managed Microsoft Cloud and Analytics retainer.

Named Artifacts

Hypercare Status ReportsTSA Exit ConfirmationRun-State Operating Model

Senior-Architect Bench Standard

Every carve-out engagement is led by a senior architect with a minimum of 10 years of Microsoft enterprise consulting experience. The senior architect is named in the Statement of Work, attends every steering committee meeting, and remains accountable through Run state.

Carve-outs come with TSA deadlines and reduced operational visibility — the buyer and the divested entity often have no shared institutional knowledge of the parent tenant configuration. A senior architect on day one is non-negotiable.

Microsoft's cross-tenant tools for a carve-out

A Microsoft 365 carve-out migration uses Microsoft's own cross-tenant tools where they fit, and tenant separation services cover what they leave out:

  • Mailboxes. Cross-tenant mailbox migration needs a Cross Tenant User Data Migration license per user, a one-time fee with no exceptions, which also covers OneDrive. Mailboxes on any hold are not migrated, and Teams meetings must be recreated.
  • OneDrive. Cross-tenant OneDrive migration schedules up to 4,000 accounts at a time and is one and done, with no delta passes. It is not supported for GCC, GCC High or DoD, and accounts on hold are blocked.
  • SharePoint. Cross-tenant SharePoint site migration is licensed per 100 GB moved and currently only for Enterprise Agreement customers. It does not move Teams content, channels or structure, and workflows, apps and Power Platform items are rebuilt in the target.
  • Identity. Microsoft Entra cross-tenant synchronization is not a migration tool, because synchronized users still authenticate in the source tenant; during a transition it keeps B2B users and security groups in step.

Sources (Microsoft Learn, accessed 2026-11-07): cross-tenant mailbox migration, cross-tenant OneDrive migration, cross-tenant SharePoint migration, cross-tenant synchronization.

Frequently Asked Questions

Which Microsoft tools move data in a carve-out?
Cross-tenant mailbox migration and cross-tenant OneDrive migration, both covered by a one-time Cross Tenant User Data Migration license per user, and cross-tenant SharePoint site migration, licensed per 100 GB moved and currently for Enterprise Agreement customers only. OneDrive and SharePoint moves are one and done with no delta passes, and Microsoft Entra cross-tenant synchronization is not a migration tool (Microsoft Learn, accessed 2026-11-07).
What is a carve-out Microsoft 365 tenant migration?
A carve-out Microsoft 365 tenant migration is a divestiture from a parent tenant into a new standalone destination tenant. It applies when a business unit is being spun off, sold to a third party, taken private, or otherwise separated from the parent organization. Unlike a consolidation migration, the carve-out requires building a complete standalone Microsoft 365 environment in 60-120 days while preserving compliance posture and meeting TSA expiration deadlines.
How does EPC Group handle TSA expiration timelines for carve-out scenarios?
Transition Services Agreements (TSAs) define how long the divested entity can keep using the parent's Microsoft 365 tenant after deal close. TSA expiration dates are non-negotiable. EPC Group runs pre-close diligence in parallel with deal-team work so Day-1 readiness lands before the TSA window closes. Typical carve-out execution is 60-120 days. Pre-close diligence support is available 30-45 days in advance when needed.
What happens to shared content between the parent and the divested business unit?
Shared content is categorized during the Separate phase into three buckets: content that moves with the carve-out (owned data, customer records, IP), content that stays with the parent (corporate functions, non-divested business records), and dual-residency content (governance documents, HR records under legal retention). Each category has a different extraction methodology. The Tooling Decision Record names AvePoint Fly, ShareGate, or Quest as the extraction engine based on permission fidelity needs.
How is identity de-provisioning handled in a carve-out?
Identity isolation runs across four layers: Active Directory accounts are exported and stood up in the new destination Entra ID tenant, group memberships are scoped to carve-out users only, license SKUs are reclaimed from the parent and assigned in the new tenant, and Conditional Access policies are rebuilt with carve-out-specific named locations and device trust. Cross-tenant access is permitted only during the cutover window. Final de-provisioning from the parent happens at TSA exit, not before.
How does EPC Group preserve compliance posture during a carve-out?
The Diligence phase establishes the regulatory baseline appropriate to the divested entity — HIPAA, FedRAMP, SOC 2, FINRA, CMMC, or GxP. Microsoft Purview sensitivity labels, retention policies, eDiscovery configuration, and Microsoft Defender alerting are rebuilt in the destination tenant before content lands. Compliance is re-validated at cutover. Named artifacts produced during the migration form the audit trail used by the divested entity's compliance team post-carve-out.
What Microsoft 365 workloads are migrated during a carve-out?
All Microsoft 365 workloads: Exchange Online, OneDrive for Business, SharePoint Online, Microsoft Teams (including private channels, shared channels, and Planner data), Power BI (workspaces, datasets, semantic models), Power Platform (Power Apps, Power Automate, Power Pages, Copilot Studio), Microsoft Purview (sensitivity labels, retention, eDiscovery), Microsoft Entra ID, Microsoft Defender, Microsoft Intune, Microsoft Viva, and Microsoft Copilot deployment readiness.
How long does a typical carve-out migration take?
Standard carve-out execution is 60-120 days from kickoff to TSA exit. Mid-market carve-outs (1,000-5,000 users) typically land at 60-90 days. Enterprise carve-outs (5,000-25,000+ users) typically land at 90-120 days. Cutover execution within that window averages 5 days. Pre-close compressed engagements can deliver Day-1 readiness in 30-45 days when EPC Group is engaged during diligence.
What is the pricing model for carve-out engagements?
Fixed-fee Statements of Work scoped during the Diligence phase. Pricing depends on user count, workload mix, identity complexity, tooling stack, and TSA timeline. Mid-market carve-outs are scoped and priced after discovery. Enterprise carve-outs are scoped and priced after discovery. Post-carve-out Managed Microsoft Cloud and Analytics retainers are scoped and priced after discovery per month for the new standalone entity.
Can EPC Group support pre-close carve-out diligence?
Yes. Pre-close diligence support is one of the most common engagement entry points. The deal team brings EPC Group in 30-45 days before close to deliver source tenant audit, carve-out scope definition, identity isolation plan, TSA exit plan, and Day-1 readiness gap analysis. Parallel workstreams mean execution can start the day after close instead of starting from a cold-state inventory exercise.
How do I start a carve-out Microsoft 365 migration engagement?
Schedule a discovery call at epcgroup.net/schedule, email contact@epcgroup.net, or call (888) 381-9725. Pre-close engagements are supported — EPC Group can be brought in during diligence to support the deal team. After the discovery call, a scoped Statement of Work is delivered naming the senior architect, the playbook phase plan, the tooling decision, and the fixed-fee anchor.

Start a Carve-Out Microsoft 365 Migration Engagement

Pre-close diligence support, TSA exit planning, standalone tenant standup, identity de-provisioning, content separation.

Or email contact@epcgroup.net

Documented and anonymized engagements

Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.

More engagements: Prairie View A&M University (Texas A&M University System) — Gmail to Exchange Online migration services (2020) · Georgia Institute of Technology (Georgia Tech Professional Education) — Microsoft Teams and SharePoint consulting services (2019) · Haskell (The Haskell Company) — Office 365 Phase 0 implementation-strategy initiative (2017) · Google Workspace and Microsoft 365 into One Tenant (2023) · Office 365 Tenant Consolidation: Four into One (2023) · Cross-Tenant Migration After an Acquisition: Life Sciences

All case studies →

AI assistant — not a human