Single Trust tenant

[johnabbots]

Hi all,

 

I’ve recently joined a Trust of around 30 schools (10 secondaries and 20 primaries) that all have individual domains and Office365 tenants. I’ve been told that one of my jobs is to join everyone together so that they can go to any school and login, share the same trust email address and collaborate with teams and OneDrive in a more effective way.

 

Although I’m sure this is all possible to me it seems like a massive project so I was looking for some pointers from people that may have already carried out this task or perhaps outsourced it.

 

All the schools currently have their own server setup with the secondaries all having recently bought decent clusters so moving everything to the cloud wouldn’t be cost efficient at this point.

 

The other issue I’m facing is staffing levels. I’ve joined the Trust but there are only 4 technicians to cover the 20 primary schools and central team so starting a project like this when we’re already firefighting seems insurmountable. All secondaries have their own local teams with a network manager and technician. If anyone is able to share their staffing levels who look after a similar amount of schools or work to a model I’d be interested.

 

I’m really struggling to think about the best way of doing this and to be honest where to start so if you had any thoughts I’d be grateful.

 

 

Thanks everyone.

[psydii]

Just jumping in naively here (no MAT experience but I saw similar done during BSF). To me (as an NM) it seems that buy in from the NMs would be the key. I'd look at bringing them together to share how they are working and what they've done to get their tenants to meet their school's needs. They are a resource you should be able to call upon to do the work, support each other and you.

 

You also need their Head Teachers to be be 100% bought in to standardizing across the Trust, and it is mostly for them to help settle the local team into the idea of change and collaboration. Once they are on board with that, they can work together to standardise how they create users in their local AD's and then develop a plan as a group to migrate to a new super tenant. The initial buy-in process is the most crucial and will need a very softly softly approach. Just this bit will probably take months. Only when you have got people all on the same page and working together can you begin the technical piece.

 

A chunk of this work is strategic Trust director-Head Teacher stuff, that you need to witness (and learn from), so when you start to work with the local NMs you are equipped to handle their (inevitable) concerns.

 

I will note however that there are now enforced limits on edu tenants which probably isn't an issue for a handful of primaries, but bringing together more than a couple of secondary's could be a problem. You might want to talk with your CSP about this.

 

I wouldn't start migrating the primaries until the Secondary NMs are on board. They need to feel they have collective ownership of the new tenant, and that will be difficult if you've already laid it out and its full of primary teachers.

[Rob_D]

From a technical standpoint...

You probably want to keep the schools as separate 365 tenants otherwise you could run up against Microsoft's new (or coming soon) size restrictions: https://www.edugeek.net/forums/cloud-services/234047-bye-bye-14-35pb-a1-plus.html

So it becomes more a matter renaming the tenants/domains into something consistent across the trust and setting up Multi Tennant management and federation:

 

If all the schools are part of the same trust and are all on board with this, then bring the secondaries' network managers in on the project and get help from their teams.

Heck, even without this project it would probably be good to get all the school's support teams communicating and helping each other out. Once you're knowledge sharing standardization across the schools becomes a lot easier, and could even happen fairly naturally.

[ITGURU]

Can the Multi Tennant management and federation only be done by MSPs as those options are not available under our tenants.

[TheHyperTechie]

I was in a similar-sized Trust as you in my previous role with roughly ~30 schools. They decided they wanted to consolidate Office 365 tenants and merge every school into one.

 

This meant we had multiple domains inside the central tenant with this format [email protected] We were only a small team of about 7; there was no way we could have handled a migration like this ourselves AND still provide a top-notch support service with fast response times along with juggling tickets on our helpdesk.

 

We paid for a company to do it for us, school by school. Usually, one or two a week so it gave us time to provide support to that school(s) regarding the migration. Some schools had always used Google, so they needed extra, whereas some schools didn't really need any as they used O365 previously, and the only thing that changed for them was their email address.

 

Something like this requires a lot of planning, and I won't lie, with only 4 technicians, it would be very stressful. If the budget allows, I would see how much it would cost for a 3rd-party company to do it. Yes... you and your team could probably do it for cheaper, but it is one less thing for you to worry about. As I am sure just providing support for it might cause some headaches!!!

[p858snake]

Also have a look at https://www.edugeek.net/forums/how-do-you-do/237157-mat-transformation.html which is also a another recent and similar request

[chaplic]

Ive done this on three and bit times (once for a firm swallowing its previously arms-length companies, once three companies into one, once for a major pharmacy and their us partner, then reversing that migration half way through - not due to tech I hasten to add…)

 

The stated desired outcome is the right one. MS has made some advances recently with tenant sharing but its still far from seamless. And economies of scale on management is a payoff too.

 

It is a tough piece of work. The best and gold-plated outcome would be azure-ad joined machines, intune managed and using sharepoint against a single tenant. If you dig into the requirement the desire is for easy collaboration, so I would consider keeping all AD domains as-is (with trusts everywhere) but all using a single O365 tenant. You get most of the collab benefits can have the single email address and over time consolidate the desktop estate to being azure ad managed and new user accounts from a single source. I did this approach for the big firm swallowing the little ones; for the second piece of work they started doing a gold plated version roughly at the same time and despite being 20 times smaller had not got anwywhere near the end goal.

 

 

At the very least Id suggest you need bought-in expertise on how to do it (so a design and early life implementation) as I just cannot see how you’d have the ‘head time’ never mind actual time. Rollout of it is a bit cookie cutter after a while, so can be distrubuted across teams

 

 

 

 

 

u

o

[Aprice]

There's definitely benefits. One thing maybe to consider though is if a school leaves the trust how do you get them out of your new 'super' tenant and back onto their own.

[Mr.Ben]

There's definitely benefits. One thing maybe to consider though is if a school leaves the trust how do you get them out of your new 'super' tenant and back onto their own.

We use AvePoint Fly for this for schools coming in, it would be the same for a school going out (We hold onto their old tenants just in case).

 

Cost is about £13 per account to migrate.

 

Sharegate would be better for secondaries as it's a yearly rather than per item fee, but is out of our reach cost wise.

[MatthewL]

I'd get everything setup as you want it domain wise, then add a trust between new domain and existing then you can slowly migrate them ove.

 

Obviosuly need to get your network routing in place first to your data centre if you are hosting the local domain in house. Would certinally look at tools for data migration will be far easier than manually.

 

You will need to scope out everything locally that is domain access that may need reconfiguring etc.

[johnabbots]

Thanks very much for all your replies. @Rob_D I think the Multi Tennant management and federation information you have posted might be a good compromise between cost, time, and effort required. Edited March 20, 2024 by johnabbots

[chrisjako]

Contact me if you want to talk to someone,- been there, done that wore the T shirt - Our MAT is on one tenant its fab but was a grind to get it to this stage