A Microsoft 365 tenant migration can look like a success long before it actually is. Mailboxes have moved, Teams and SharePoint work, and the project closes on schedule.
But consolidation is also a large-scale change to identity, access, and policy, made under time pressure. The risk that follows usually traces back to what each tenant brought along and the shortcuts taken to hit the date.
Most consolidation risk is inherited
Every tenant you merge carries its own identity sources, authentication methods, Conditional Access policies, and MFA enforcement. Add standing administrative access and a tangle of third-party apps and mail flow integrations, and it’s easy for a Microsoft 365 tenant migration to carry every weakness forward. Three decisions help before any user is touched:
- Decide which tenant sets the standard by choosing the one that best represents your long-term operating and security model.
- Review what you are inheriting across every tenant in scope, including Conditional Access, MFA enforcement, privileged roles, and standing admin access.
- Agree who decides by naming who approves access changes, exceptions, and rollbacks.
Without that, those calls get made ad hoc, in the middle of the project, by whoever happens to be online.
Start with a target tenant that’s better than what you’re merging
If the target tenant isn’t ready, everything you migrate inherits its weaknesses. For any Microsoft 365 tenant migration, set baseline Conditional Access and device compliance policies, confirm logging, auditing, and alerting are on, and clear out unused accounts, stale guests, and orphaned objects. Every account you remove now is one less identity to migrate and secure later.
The migration window is where risk peaks
Scale, time pressure, and productivity demands all push toward shortcuts. A broad permission granted “just for the weekend” has a way of outliving the project. During the move:
- Avoid blanket temporary permissions and grant what each step needs, not more.
- Automate where you can, since repeatable moves reduce manual error and ad hoc access grants.
- Monitor for privilege spikes and policy drift as the move happens, and audit access changes throughout.
It isn’t finished until the temporary access is gone
Consolidation is not complete until temporary admin roles, trusts, and synchronization jobs are removed and unused tenants are archived and decommissioned. Leftover access is exactly the kind of exposure that attackers look for. A useful test is whether you can say all of the following:
- Access is more consistent and easier to understand
- Privileged access is reduced and better governed
- Visibility across identity, access, and activity has improved
- The approach can be repeated safely for future consolidations
If any of those is a no, the consolidation isn’t finished, whatever the project plan says.
Put it into practice
The tenant consolidation readiness checklist can help IT and security teams work through each of these phases, from establishing a safe baseline to confirming you are better off than before, before a rushed move turns into lasting risk.
Download the Quest tenant consolidation readiness checklist →
To see how Quest approaches this work, learn more about Secure Migration.
