Merging Tenancies - Considerations and best practice

[CyBeRkId2002]

Afternoon all,

 

Presented the other day to our trust leadership team on the topic of whole trust collaboration. After discussing the various approaches and considerations around Single vs Multi-Tenency it seems very much like they would require the short-term disruption of merging all schools tenency's - for the increased ease and prospect of collaboration further down the line.

 

As such I am now preparing a paper on the subject for presentation next month. I thought this would be a good place to gather my thoughts and ask relevant questions. Below are some of the things I am currently considering:

 

Licensing

Had a brief chat with our licensing partner and this sounds more straight-forward than I was expecting. It seems that we will setup a new trust agreement when our largest school is up for renewal in September / October and then other schools will get added to the agreement and tenency as they renew further down the line. The only other thing I need to consider is each tenency also has a handful of Azure P1 licences so will need those to migrate across too!

 

Technicalities

We will be looking at a software solution to support this! I cannot even begin to fathom the complexities of bulk exporting PST's for users, let alone Teams groups, Sharepoint and all the other links that systems have. Has anyone paid for software to do this and what are the good, bad and ugly things you can tell me.

 

Am I right in thinking the simplified version is: Users get provisioned in new system, domain gets transferred across, Mail gets moved using old @school.onmicrosoft.com address as source, and new email address as target?

 

Multi-School AD Sync

Fortunately at present we are a single secondary school with 6 small-ish primaries. At present each school has it's own AD domain and, fortunately, the only school which syncs using the AD Sync tool is the secondary. This would work for now but with an eye on the future can you sync more than one domain to a tenency - or is this the point I am going to start looking at the next stage which is a centralised AD (something we are not quite ready for yet!)

 

Other considerations

Things that are also on my radar include:

 

• Appropriate retention policies
  
• Setting teams to work correctly for primary and secondary
  
• GDPR / Safeguarding considerations (isolating address lists for example)
  
• 
  

 

Any comments on any of the above, any whitepapers / plans people have made who have gone through similar would be greatly appreciated.

 

- - - Updated - - -

 

Should also add, for anyone looking to do similar, I am happy to share knowledge and experience the other way and we could work through this rather daunting task together!!!

[Boredguy]

We are planning on doing something similar with all our secondary schools, but also going down the route of moving us all over to a single AD domain as well due to the ADSync limitations.

 

We're likely to be doing the migration ourselves using the MS powershell scripts so that will be fun.

 

Regarding the isolating address lists, that is actually very simple to do using the OWAMailboxPolicy, and we've had that in place for years on our tenancy so that students don't get the Governors and support staff in their address list.

We already have standardised our retention policy and Teams policies but we will recreate them as it doesn't take too long.

As for moving Teams over... we already have powershell scripts and SIMS reports for creating and adding the users so that task shouldn't be bad, but might see if https://docs.microsoft.com/en-us/sharepointmigration/how-to-use-the-sharepoint-migration-tool can be extended to copy over the content as well (since we will be using it to copy over staff files)

[Theblacksheep]

Afternoon all,

Am I right in thinking the simplified version is: Users get provisioned in new system, domain gets transferred across, Mail gets moved using old @school.onmicrosoft.com address as source, and new email address as target?

 

Multi-School AD Sync

Fortunately at present we are a single secondary school with 6 small-ish primaries. At present each school has it's own AD domain and, fortunately, the only school which syncs using the AD Sync tool is the secondary. This would work for now but with an eye on the future can you sync more than one domain to a tenency - or is this the point I am going to start looking at the next stage which is a centralised AD (something we are not quite ready for yet!)

 

 

Highly recommend a new single domain and migrating old content when/where required. Good opportunity to bin old rubbish while you are there and set new standards, now might be the time to use more of a cloud service for storage, rather than local and individual needs. Good time to get rid of the needless overhead of managing multiple domains too. So much efficiency potential here.

 

I try to look at it as "what would I do if I started fresh" and work backwards, rather than making small steps and managing the mess.

[chaplic]

The 'everyone in one domain' vs 'everyone in O365 first' is something where the is no correct answer

 

However, if your focus is on end-user enhanced collaboration in O365 you'd want them to realise those benefits as early as possible. You could hookup Azure AD connect to the the other AD domains and have those people collaborating this afternoon..

 

It does leave technical debt behind (lots of AD domains) but a AD->AD migration is not trivial either and doing it the way round I've suggested brings end user benefit first. Users will not see any direct benefit from an AD to AD migration.

 

 

Real-world example, I used the approach described above to merge a ~80k seat organisation with about a dozen AD domains into a single Office 365 tenant. A the same time another two orgs merged, and went for a brand new domain, brand new office365 and brand new AD, brand new win10 for 2500 users. I finished the 80k seat piece before the 2500 user project barely had a few devices down..

[CyBeRkId2002]

Hi @chaplic - Are you saying it's possible to do multiple AD-syncs to a single tenency? That is what I thought you couldn't do.

[chaplic]

Absoloutley, yes! It's still a single instance of Azure AD Connect but you add mutliple ADs. Here is my test rig syncing two seperate ADs

[kennysarmy]

Afternoon all,

 

Presented the other day to our trust leadership team on the topic of whole trust collaboration. After discussing the various approaches and considerations around Single vs Multi-Tenency it seems very much like they would require the short-term disruption of merging all schools tenency's - for the increased ease and prospect of collaboration further down the line.

 

As such I am now preparing a paper on the subject for presentation next month. I thought this would be a good place to gather my thoughts and ask relevant questions. Below are some of the things I am currently considering:

 

Licensing

Had a brief chat with our licensing partner and this sounds more straight-forward than I was expecting. It seems that we will setup a new trust agreement when our largest school is up for renewal in September / October and then other schools will get added to the agreement and tenency as they renew further down the line. The only other thing I need to consider is each tenency also has a handful of Azure P1 licences so will need those to migrate across too!

 

Technicalities

We will be looking at a software solution to support this! I cannot even begin to fathom the complexities of bulk exporting PST's for users, let alone Teams groups, Sharepoint and all the other links that systems have. Has anyone paid for software to do this and what are the good, bad and ugly things you can tell me.

 

Am I right in thinking the simplified version is: Users get provisioned in new system, domain gets transferred across, Mail gets moved using old @school.onmicrosoft.com address as source, and new email address as target?

 

Multi-School AD Sync

Fortunately at present we are a single secondary school with 6 small-ish primaries. At present each school has it's own AD domain and, fortunately, the only school which syncs using the AD Sync tool is the secondary. This would work for now but with an eye on the future can you sync more than one domain to a tenency - or is this the point I am going to start looking at the next stage which is a centralised AD (something we are not quite ready for yet!)

 

Other considerations

Things that are also on my radar include:

 

• Appropriate retention policies
  
• Setting teams to work correctly for primary and secondary
  
• GDPR / Safeguarding considerations (isolating address lists for example)
  
• 
  

 

Any comments on any of the above, any whitepapers / plans people have made who have gone through similar would be greatly appreciated.

 

- - - Updated - - -

 

Should also add, for anyone looking to do similar, I am happy to share knowledge and experience the other way and we could work through this rather daunting task together!!!

 

Interesting, back when our new 900 school was first being talked about I had thought it would be a separate entity but things certainly seem to be moving on.

 

Now I am thinking a two school MAT should have a single tenancy / AD structure.

 

Will follow thread with interest and if there is anything you have that has swayed you to your decision I'd love to read it.

[CyBeRkId2002]

Hi all.

 

Still very much investigating this - have had to put it on the backburner for the last couple of days.

 

Some thing I have considered in the last couple of days:

 

• given our current connectivity much of what I would like to achieve in an ideal world is going to be tricky! We do not top-slice/retain/whatever you want to call it for any services so schools would have to approve any significant change. Telling a school with ~100 students on-roll that their conenctivity costs are going to double/triple is going to be a no-go!
  
• I don't think the merging of our tenencies HAS to coincide with merging of licensing. We have very little online licensing (Azure P1 at all sites for MFA, a handful of A3 licences for live events at the secondary etc.) and I believe these can be migrated across as schools come onboard - whether or not they are up for renewal!
  

 

Will keep this post updated with our journey!

[hellgate24]

Went through something similar last year with 2 secondaries migrating their 2 individual tenancies into a new shared tenancy. Ended up using a tool called BitTitan to do most of the heavy lifting for us, took care of mailboxes, onedrives, Teams, SharePoint sites, you basically just map source to destination and it does the rest. Very slick.

 

Had to ditch SSO though as the previous network manager though it was a good idea to create 2 separate standalone domains for both schools and call them the same thing