Migrate Two Active Directory Forests to One Microsoft 365 Tenant
Question details
Plan the migration of users and mailboxes from two Active Directory forests and Exchange organizations into one Microsoft 365 tenant.
- Product
- Microsoft 365, Microsoft Entra Connect Sync, and Exchange Server
- Device & OS
- not provided
- Scenario
- Two trusted forests use the same email domain, host separate Exchange organizations, and synchronize identities through Azure AD Connect. The administrator is evaluating hybrid and cutover migration options.
- Observed behavior
- Identity synchronization is working, but the administrator needs a supported mailbox migration approach and clarification on using two migration endpoints.
Inventory the Exchange versions, mailboxes, accepted domains, and synchronization configuration in both forests. Identify duplicate users and email addresses, and confirm which objects represent the same person before changing synchronization or mail routing.
Plan identity synchronization and validate a multi-forest Exchange migration
Use this approach to establish a consistent identity model and select a supported migration design for the two Exchange organizations.
Microsoft Entra Connect Sync, formerly Azure AD Connect, supports several multi-forest topologies. A two-way trust alone does not establish which topology or Exchange migration design applies.
A source anchor identifies an object across synchronization cycles; it is not the same attribute as a user principal name (UPN). Configure matching rules for related objects and ensure each synchronized identity has a stable, unique source anchor and an appropriate UPN.
Open Microsoft Entra Connect on the synchronization server and review the configured directories and matching rules. Map users, contacts, and mailboxes across both forests to determine whether they represent separate people or related objects.
In Microsoft Entra Connect, use Configure to review connected forests and domain or organizational unit filtering. Test a small, representative set of users and contacts before expanding the synchronization scope.
In the Microsoft Entra admin center, review synchronized users for duplicate UPNs and proxy addresses. Confirm that object matching and source anchors produce one intended cloud identity per person.
Review accepted domains, mail routing, Autodiscover, certificates, and recipient visibility for both Exchange organizations. Work with Microsoft migration specialists to validate a supported hybrid or other migration design for the shared email domain.
After selecting a supported design, use the Exchange admin center migration tools to test a small group of mailboxes. Verify sign-in, mail flow, Autodiscover, and access before scheduling further moves.
Evaluate whether cutover migration fits the two Exchange sources
Use this check if you are considering cutover instead of a hybrid migration.
Use WPS Office for documents during your Microsoft 365 transition
WPS Office is a free, lightweight alternative with a familiar interface and Microsoft Office format compatibility. It can help users continue working with documents during a transition, but it does not migrate Microsoft 365 tenants, identities, or Exchange mailboxes.
Frequently Asked Questions
Can one Microsoft 365 tenant receive users from two Active Directory forests?
Yes. Microsoft Entra Connect Sync supports multi-forest configurations, but the forest topology, object matching rules, UPNs, and source anchors must be planned so the intended identities synchronize correctly.
Can I use two endpoints in one cutover migration batch?
A cutover batch uses a connection to a source environment; two endpoints do not combine separate Exchange organizations into one cutover source. Confirm the supported migration sequence and batch limitations with Microsoft before proceeding.
Should the UPN and source anchor have the same value?
Not necessarily. The UPN is a sign-in name, while the source anchor is used to identify the synchronized object. Review both in the Microsoft Entra Connect configuration and ensure the source anchor remains stable and unique.
Does a two-way forest trust guarantee that hybrid migration will work?
No. A trust does not by itself establish a supported hybrid configuration. Exchange versions, identity matching, shared-domain routing, certificates, Autodiscover, and coexistence must also be evaluated.
Can I keep directory synchronization enabled during a cutover migration?
Standard cutover migration has directory synchronization restrictions. Review Microsoft's current cutover requirements and confirm the procedure with Microsoft before changing the existing synchronization configuration.
