Multiforest migration to Office 365

[Newlife]

Hi Community, 

One of our customer has the below environment:

Goal:

All below forests needs to be synchronized to a single office 365 tenancy ( which could be a brand new tenancy ) so they can keep single email name space, single SharePoint, single one drive organisation for all forests.

FOREST A

Exchange 2013 on-prem and EXO in Hybrid

ADFS is installed to sync Security enabled AD groups to O365.

Users using SharePoint Multiple sites and OneDrive

SSO enabled by ADFS, no write back

2250 mailboxes hosted in EXO

FOREST B

Local AD in on-prem

No hybrid

AAD sync installed to sync to O365

1700 mailboxes hosed in EXO

No SPO/OneDrive users

FOREST C

Local AD in on-prem

No hybrid

AAD sync installed to sync to O365

1800 mailboxes hosed in EXO

No SPO/OneDrive users

FOREST D

on-prem Exchange 2013

500 mailboxes hosted on-prem

Questions:

How can we plan for it?

Any Best practices?

Many thanks in advance. 

[#2]

@Newlife Start reading: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies

Then the planning depends on who must go first(duplicate names for the desired shared namespace), timing, coexistence for free busy, GAL sync and different approaches for each scenario, as you may be able to move the data to the target tenant using native tools for the on-premise only environments and use 3rd party tools to move data for the tenant to tenant or save and export data depending on legal holds, archiving, journaling, relays that are in place on each forest. 

Regards

Erick

[#3]

Hi @Newlife,

Based on your scenario the advice is to migrate Forest B,C and D to Forest A using a third-party tool and then when you have all consolidated on the same active directory and hybrid implemented, you can migrate to online.

Or you can create all users on Forest A, synchronize them and use a third-party tool to migrate the data from Tenant to Tenant.

Read more here https://docs.microsoft.com/en-us/exchange/mailbox-migration/migrate-mailboxes-across-tenants

Best regards,

Nuno Árias Silva

[#4]

@Nuno Silva Thank you very much for your inputs. 

I don't think your first approach (moving Forests B, C, D to forest A and then migrate to Office 365) will help because we're creating brand new tenant in Office 365 and then we need one more tenant to tenant migration which can be done by 3rd party tool only. right? please confirm. 

[#5]

Hi @Newlife,

You can create a new tenant and use a third-party tool to migrate all your data to a new tenant, but if you have an infrastructure already implemented with hybrid and using many services and have a lot of users compared to all other forests. The best way for time and cost is to consolidate all into the Forest A and then migrate the others, but you can migrate all to a new tenant if you need it. All of these migrations depending on the workload you are using you need to use third-party tools to each of workload.

Best Regards,
Nuno Árias Silva

[#6]

@Nuno Silva - now the approach have got slightly changed. 

It has basically 2 phases:

Phase 1 :

Keep any one of the Office 365 Tenant and leverage single AAD Connect to sync from all the 4 on-prem ADs to this Office 365 Tenant.

Phase 2:

Create the brand new Office 365 Tenant and leverage Skykick for tenant to tenant migration.

Let's focus on Phase 1 and

Is there any best practices to complete Phase 1?

Many thanks!

[#7]

Hi @Newlife,

The best way to archive the phase 1 please read the section "Multiple forests, single Azure AD tenant" on the following link https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies.

After identity is implemented in place, that you can start migration.

Best Regards,
Nuno Árias Silva

[#8]

@Nuno Silva - Thank you for your prompt response. 

Let's say, on Phase 1,

We'd only need to migrate just the ADs from Forest B, C, D to Forest A and not the Exchange/SP severs, will it be the same approach or do we need to leverage ADMT tool?

Another question is, in order to keep only one AAD connect to sync objects from all other ADs, where do we need to place the AAD server, is that on domain joined, or DMZ zone?

Please assist.

[#9]

Hi @Newlife,

You can use ADMT to migrate from Domain A to B and Etc, but depending on the final scenario.

The AAD Connect will need to access to all AD's. 

Best Regards,
Nuno Árias Silva