Migration patterns, Quest tooling notes, and operational lessons from the LeadThem team.
On-prem AD still gives you direct command over the directory in ways the cloud identity layer cannot yet match. That gap is not going away soon, and it shapes every migration or consolidation conversation I have with IT leadership. The...
That shift in framing is worth watching. Most programs still treat on-prem directory recovery as a backup task and cloud identity as a governance task, yet the two are inseparable once an attacker moves laterally. Over the next 12 to 36...
Entra ID is no longer optional infrastructure. It sits at the center of access for most enterprises, and when a flaw like this surfaces the blast radius is immediate. The market still underestimates how tightly AD, Entra ID, and backup...
I have seen how easy it is to underestimate the back-and-forth between source and target identities. One mismatched account and permissions start landing in the wrong place, which then shows up in the middle of cutover. The teams that keep...
The market numbers back this up. Post-merger integration consulting is projected to grow from 1.34 billion to 4.17 billion by 2035. That growth tracks with what we see on the ground, where the volume of AD and Microsoft 365 consolidation...
Tools that promise full automation for these scenarios are useful, but they still require careful mapping of source and target objects upfront. Without that step, permissions and access patterns break even when the data transfer succeeds....
In the projects I run, we spend real time on the source side before any waves start. Matching accounts correctly and reviewing what has access to what prevents those stale rights from landing in the new tenant. If you skip that step, the...
The timing matters. Agents are being spun up faster than most security teams can inventory them. Once they start accessing resources and making decisions, they become part of the same attack surface as every other account. Leaders who...
What actually holds up tenant-to-tenant work: Mailbox and OneDrive cutover sequencing rarely lines up cleanly with Teams. Chat history, private channels, and shared channels each have their own constraints, and if you move mail before you...
We migrated a 365-user semiconductor acquisition across tenants with one major complication: the source environment had Microsoft Purview sensitivity labels applied broadly, which meant AIP-encrypted mailboxes, OneDrive, Teams, and SharePoi
A few patterns I've watched repeat in the field: The discovery phase gets compressed because someone assumes the source tenant is well-documented. It never is. Shared mailboxes, delegated permissions, retention policies, and third-party...
Even so, the real friction in these projects still shows up in the dependencies. Shared mailboxes, delegation chains, and apps tied to specific identity objects often surface only after the first pilot wave runs. Identity matching has to...
In my experience working with IT teams through acquisitions from a few dozen users up to large logistics roll ups, the friction almost always surfaces in Active Directory consolidation and Microsoft 365 tenant decisions. Shared calendars...
Most of the data loss conversations I've been in started long before cutover. They started when somebody approved a wave list without checking license assignment in the target, or assumed a mail-enabled security group would carry...
Here is how it has to sequence when you are working in Quest ODM. Identity first. Always. Before a single mailbox or OneDrive byte moves, source and target accounts need to be matched and provisioned correctly. ODM drives this through its...
That is not a criticism. It is just how the sequence works. You scope based on what the customer knows, what they can share in a pre-sales conversation, and what discovery has surfaced so far. Then you get into the actual forest, the...
That is not a product problem. MSPs who have used Quest ODM call it the most complete M365 migration toolset on the market. The end-user experience across Exchange, SharePoint, OneDrive, Teams, and Entra ID moves together in one...
The projects that go sideways fastest are the ones where someone compressed the planning phase to hit a deadline. Discovery gets skipped or done shallow. The pilot runs once, nothing gets validated, and wave one becomes the real test...
The first wasn't a shock. Over 100K users, years of continuous acquisitions and divestitures, and a directory that had absorbed multiple forests without much cleanup along the way. By the time we were doing pre-migration assessment,...
Microsoft published a post titled "What Changed in RC4 with the January 2026 Windows Update and Why It Is Important" on the Tech Community Core Infrastructure and Security Blog that is worth reading before your next migration planning...
Most Active Directory migrations look straightforward until you factor in four internal teams, a corporate separation, and a logistics operation that never stops running.
Managing infrastructure at scale, I know that consolidating domains isn't just about reducing hardware; it's about tightening security and simplifying management. In one project, we cut domain controllers from 350 to 60, which directly...
In my experience leading domain consolidations, moving to PHS simplifies the architecture and cuts down on those legacy servers that are prime targets. At scale, with thousands of endpoints, we've seen how it streamlines disaster recovery...
At LeadThem Consulting, we've guided clients through these transitions using Quest tools like Migration Manager to handle the heavy lifting. We focus on mapping out the identity landscape first, ensuring that access controls and governance...
I've seen shops lock in a daily backup schedule without ever asking two questions: how much is our AD actually changing, and how much of that change are we willing to recreate if we have to restore from yesterday's backup? Those two...
In my experience leading integrations, from small teams of 10 to enterprises with 80,000 users, these non-human identities often fly under the radar until a migration forces the issue. They hold onto privileges that make a compromised...
Here's the pattern I see. A company has solid backups for servers, endpoints, and even SharePoint. Ask them what happens if a bad actor or a bad script wipes out conditional access policies, app registrations, or a few thousand group...
What strikes me is how these acquisitions signal a broader industry shift toward integrated, scalable security platforms. Customers are demanding more than point solutions; they want ecosystems that anticipate the next 12-36 months of...
The argument is one LeadThem Consulting has watched play out across hundreds of Active Directory, Entra ID, and Microsoft 365 migrations: identity security has been treated as three disconnected problems. Detection lives with the SOC....
Entra ID first, then Exchange, then SharePoint and OneDrive - fine on paper. What breaks in practice is everything downstream of identity: conditional access policies that don't survive the cutover, guest accounts pointing at the old...
