MAT - Multi tenants - merge to single tenant - Feedback wanted regarding issues and experience

[IT_Man_Dan]

Afternoon all,

 

We are a trust where member schools currently have separate M365 tenants and we are exploring moving to a single tenant.

Please can anyone who has done similar share their experience including details of any issues that occurred that weren't identified in the planning phase?

Also please share whether you completed the project in house or involved a third party.

 

Lastly, what would you do differently?

 

I look forward to hearing your thoughts and experiences.

 

Many thanks

Dan

 

[gszech]

We did the exact same thing recently, but with Google instead of Microsoft. We brought three schools together under one main email and web setup.

It’s completely fine to do as long as you plan ahead. The main work is just updating email addresses everywhere, on school websites, and login accounts. You have to give staff and parents plenty of time to change their details before you make the switch.

 

For our layout, we kept each school's name in the address, like schoolname.trustname.com

 

I would definitely do it again. Managing everything is way easier now because we only have one admin account to log into instead of three. Buying subscription is much easier too, we can just buy one deal for the whole trust now, or just for a single school (subdomain) if needed.

 

[fiza]

7 minutes ago, gszech said:

We did the exact same thing recently, but with Google instead of Microsoft. We brought three schools together under one main email and web setup.

It’s completely fine to do as long as you plan ahead. The main work is just updating email addresses everywhere, on school websites, and login accounts. You have to give staff and parents plenty of time to change their details before you make the switch.

 

For our layout, we kept each school's name in the address, like schoolname.trustname.com

 

I would definitely do it again. Managing everything is way easier now because we only have one admin account to log into instead of three. Buying subscription is much easier too, we can just buy one deal for the whole trust now, or just for a single school (subdomain) if needed.

 

Were the schools already using Google? How did you deal with Google classrooms that the schools don’t want to lose?

[gszech]

Great question. We actually didn't do a full classroom migration-we were merging two primary schools that barely used Google Classroom to begin with.

 

I've moved teachers' emails and Google Drive data using the migration tools, asked teachers move whatever files they needed over to the new domain, and gave them a one-year window to jump back into the old domain if they forgot anything. From what I remember I also had to migrate calendars manually, but this was an easy export.

 

Edit: Just remember that we also had to move Google Chromebook device license from old domains to the new domain. This took some time and I've had to contact a separate team for this. Google overall was not very helpful with the migration. They offer great easy to use tools to migrate data from Microsoft. I thought that migrating from Google to Google can with one button click but this was not the case. 

 

My suggestion is to plan everything and communicate with staff.  Be patient with this as even now 2 years after we changed over I'm still getting emails from staff asking to access old emails so they can update their password for some service. 

Edited September 24 by gszech

[DGardiner]

weve used cloudm in the past to merge stuff when we take over 365/google schools into our trust google tenancy it works well.

 

id like to see how the new google migration stuff works though as that would save a nice chunk of money and we have 2 365 schools coming up to do and from memory the local authority have a single tenancy for the whole area so its a bit of a drama to get sorted...

[IT_Man_Dan]

Extra info, We are looking to merge them into a single M365 Tenant, not moving to Google.

Sorry, I should have been clearer.

[Frodo_Baggins]

11 minutes ago, IT_Man_Dan said:

Extra info, We are looking to merge them into a single M365 Tenant, not moving to Google.

Sorry, I should have been clearer.

We've done 365 and Google, for 365 we used powershell\salamander to create accounts, mailboxes and groups, added and verified domains, used mover.io for OneDrive\SharePoint\mailboxes 

23 tenancies to one but have not done cross tenancies 

Edited September 24 by Frodo_Baggins

[psydii]

Never done it, but when I was paying attention to this sort of thing, Sharegate was the tool to use.

I'd have though, as ever, it depends. Particularly on whether any of the schools have got "business processes" enabled by 365 that depend on more than just files and email.

 

Just of the top of my head, things that might trip up the unwarey:

 

Custom mail flows, rules etc

Forms

PowerAutomations

CoPilot

Sensitivity Labels

Data loss policies

Communication compliance policies

ediscovery case history

licencing automation/edge cases

Users that ought to be  shared mailboxes

Teams that ought to be shared mailboxes.

Distribution lists

secondary email addresses on users, distribution lists, groups, teams etc.  (where do the important emails to things like safeguarding/dsl, data protection, security, noc, hostmaster, the primary apple DEP account, and other 3rd party admin tools really go? See also things like admin and finance (though those are obvious ones that nobody's going to forget about).

Teams that represent operational groups within the school that the MAT might not be aware of.

Teams Policies

Teams Telephoney settings, etc.

Unusual permissions at the top of Sharepoint collections.

Unusual permission deep inside SharePoint collections.

legacy email address policies 

customised quarantine arrangements for certain mailboxes.

local knowledge in how to deal with various alerts containing sensitive information in quarantine, communication compliance etc etc)

Entra Enterprise Apps (and all the DPIAs you're going to have to do to bring over anything you don't have already set up)

3rd part integrations - everything that pulls from Entra, and how that is configured.

Conditional Access policies

Custom Indicators in Defender.

Edge policies

Defender policies
InTune (settings, remediation scripts, include/exclude rules etc etc)

Intune Autopilot (groups/tags)

Personal devices in Intune.

Any Integration of 3d party MDMs.

Any integration with 3rd part identity providers or plugins (e.g. for Apple Devices)

I've probably missed a few. 

[londonbg]

1 hour ago, Frodo_Baggins said:

We've done 365 and Google, for 365 we used powershell\salamander to create accounts, mailboxes and groups, added and verified domains, used mover.io for OneDrive\SharePoint\mailboxes 

23 tenancies to one but have not done cross tenancies 

 

Mover.io was purchased by Microsoft I believe and shut down in it's previous Swiss army knife guise which fits in quite well with my admittedly somewhat paranoid worldview about the ens**ttification of everything..!

[ifarmery]

We did this with Quest in Demand. 20 tenants into one.

 

Depends on what cloud services you currently use now. Our users kept same email addresses which complicated certain things more. Our devices remained AD Joined, we moved them to Intune a year after but in hindsight we should’ve done everything at the same time but didn’t have the man power to physically do this.

Mobile Phones - Android we’re the worst but also iPhones really struggled to let go of the old tenant we had to do this in most for the users - Clear Cache

Microsoft Forms - Quest didn’t migrate these so we had to share the collaborate link with new account
 

Onedrive Sync - If you aren’t wiping machines I’d recommend clearing profiles, we didn’t and it caused lots of issues of the old Oendrive showing and led to files being saved in the non synced area.

 

I spent weeks assessing what each tenant had, user, files, groups etc wise. We still missed certain services that staff had made use of (Microsoft Planner)

 

hope this helps, might sound a pain but having all users in one tenant is so much easier now.

 

Ian 

 

 

[Sylv3r]

We've done it - 48 schools into one single O365 tenancy. Some schools decided they were happy to start again with fresh inboxes, others wanted their previous mail moving over.

 

We used CodeTwo in the beginning for a small number of schools, but in the end just exported and imported the PST's and used the sharepoint migration manager to move their documents from local servers up onto OneDrive.

 

For those schools who were previously with LA's, they downloaded the PST's for us (as they obviously weren't going to give us GA access to their tenancy) then we uploaded them.

 

Now we've got all school data up into the cloud it was one of the first things we did when schools joined our trust and it's massively helped with regards to communication / sharing documents / online meetings etc and it's probably one of the best things we have done.