TSA Exit Acceleration
Off the seller’s Microsoft tenant. On schedule.
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
TSA Microsoft 365 separation is the discipline of moving Newco identities, mailboxes, files, and collaboration data from the seller tenant into a Newco tenant with licensed entitlements, supported configurations, and a clean security boundary. The work runs inside the broader TSA exit strategy framework. The platform that looked easiest in due diligence is the platform where carve outs miss day one most often. The reason is the volume of small dependencies and the unforgiving identity boundary.
Microsoft 365 separation starts with a complete tenant inventory. The seller tenant identity in Entra ID. The licensed services covering Exchange Online, SharePoint Online, OneDrive for Business, Teams, Microsoft Defender, Intune, Power Platform, and the optional services. The user, group, and license assignment landscape for the in scope population. The data footprint covering mailboxes, OneDrive contents, SharePoint sites, Teams channels and chats, and the Power Platform environments. The domains, custom DNS records, and verified sender authentication configuration.
The target strategy is almost always a new Newco tenant. Microsoft does not provide an in place split as a standard service. Newco signs its own Microsoft 365 agreement, stands up a new tenant, and migrates data and identity from the seller tenant into the Newco tenant during a defined cutover window. The seller tenant retains seller content and Newco content is removed after migration verification.
The scope boundary defines what Newco takes and what stays. Newco employee mailboxes, OneDrive contents, and personal Teams chats move with Newco. SharePoint sites and shared Teams that belong to Newco move with Newco. Power Platform apps that support Newco processes move with Newco. Anything that supports seller processes stays with the seller. The boundary is finalized in the first 30 days of the runway and reflected in the migration plan.
A clean inventory and target strategy decision unlocks every downstream decision. The licensing structure. The identity design. The migration approach. The integration redesign. The pattern aligns with the TSA exit IT separation sequence and the broader day one IT readiness plan.
Microsoft 365 licensing is sold through Enterprise Agreement, Microsoft Customer Agreement, or Cloud Solution Provider channels. The seller agreement does not transfer in a carve out. Newco signs a direct Microsoft agreement covering the SKUs in scope and the user count. The negotiation is a one shot opportunity. Microsoft reads the situation as a captive buyer with carve out timing pressure.
The preparation covers SKU selection by user persona, add on selection covering Defender, Intune, Power BI, and Copilot, term length, and the BATNA. Where Newco can credibly select Google Workspace for a portion of the workforce, the negotiation has some leverage. Where Newco is committed to Microsoft 365 across the workforce, leverage comes from the commercial structure including price holds, ramp schedules, and pre committed Azure consumption that earns discounts.
Implementation services are the second commercial. Newco selects a Microsoft Gold or Solutions Partner with tenant to tenant migration experience or a specialist migration tool vendor such as Quest On Demand, BitTitan, or AvePoint. Selection criteria include carve out experience, fixed-fee willingness, senior team continuity, and clean contractual remedies for delay. The implementation contract is fixed fee for defined deliverables with disciplined change control.
Where the seller provides Microsoft 365 services through a TSA bridge, the TSA pricing is negotiated to a cost-plus or fixed-fee structure with a defined exit ramp. The seller cannot bill Newco a mark-up on Microsoft subscription costs that the seller is not actually incurring. The audit discipline runs through the TSA audit rights framework.
Tenant build is the central engineering activity. The implementation partner provisions the new Newco tenant, configures the verified domains, sets the security and compliance baseline, and stands up the foundational policies in Exchange Online, SharePoint Online, and Microsoft Defender. The configuration mirrors industry baselines and adjusts to Newco operating model and security posture. Conditional access policies, sensitivity labels, and data loss prevention rules are designed before the first identity is provisioned.
Identity design is the most consequential workstream. Newco identities migrate from the seller Entra ID into Newco Entra ID. The migration uses a combination of new user creation, mailbox migration, and conditional cross tenant access. Microsoft cross tenant synchronization can stitch tenants together during a defined co existence window. Users keep working with familiar identities while the migration completes in the background.
The user principal name strategy is finalized early. Newco users typically receive a new UPN in a Newco verified domain at cutover. The seller domain is split where necessary so that Newco can host the relevant DNS records. Mail flow rules during co existence route mail correctly between the two tenants. The boundary is documented for every user group with explicit dependencies on Office 365 add ins and third-party applications.
Device management migrates from seller Intune to Newco Intune. The devices re enroll into the new tenant with policies that match the Newco security baseline. The autopilot configuration, the application deployment baseline, and the compliance policies are configured before the first device migrates. The discipline aligns with the day one cybersecurity plan.
Mailbox migration uses Microsoft native cross tenant mailbox migration or third-party migration tools. The mailboxes copy with folder structure, calendar items, contacts, rules, and signatures. The migration is incremental with a series of delta passes until the cutover delta is small enough to migrate inside the cutover window. Shared mailboxes, resource mailboxes, and distribution lists migrate alongside user mailboxes.
SharePoint migration is the workstream that most underestimates. Newco site collections move using SharePoint Migration Tool or third-party tools. The migration preserves document libraries, lists, permissions, and version history. Web parts and custom solutions are inventoried and rebuilt where they do not migrate cleanly. The migration window is sized to the data volume and the supported migration throughput.
Teams migration covers Teams channels, channel files, channel chats, and apps. Cross tenant Teams migration is supported through Microsoft and partner tools. The chat history migrates where the tool supports it. The Teams external sharing and guest access configuration is rebuilt in the Newco tenant before user provisioning. Phone system and meeting room configurations migrate alongside Teams.
OneDrive migration moves personal content per user. The migration uses native or third-party tools with delta passes. The redirect from the legacy URLs to the new URLs runs through the migration tool. Sharing relationships to internal and external collaborators are preserved where supported. Where Office 365 Groups own data, the groups migrate alongside the underlying assets.
Cutover is the window where Newco users move from the seller tenant to the Newco tenant. The window is typically planned for a long weekend with a defined freeze on mailbox and file activity Friday afternoon and Monday morning go live in Newco. The runbook covers DNS cutover, mailbox redirect, file redirect, identity activation, and device re enrollment. The runbook is rehearsed twice before the actual cutover with timed steps and rollback triggers.
Co existence is the period before final cutover where users in the seller tenant collaborate with users in the Newco tenant. Cross tenant guest access, B2B collaboration, and federation arrangements support this. The co existence configuration is documented for every relevant integration including the meeting rooms, the calendaring boundary, and the file sharing patterns. Co existence is a TSA service that is priced and time bound.
Third-party application re entitlement is the workstream that always lands later than planned. Every SaaS application that integrates with the seller tenant has to be reauthorized with the Newco tenant. Marketing tools, document management, signing platforms, sales engagement tools, and dozens of smaller integrations. Each application is inventoried and assigned a re entitlement owner before cutover.
Stabilization runs for 60 to 90 days. Production issues get triaged within defined service-level commitments. The TSA exit certification for productivity services follows successful stabilization. The discipline runs through the TSA exit milestones framework and the IT operations playbook.
Microsoft 365 separation programs run between $400K and $3M depending on user count, data volumes, third-party integration count, and the chosen tooling. The cost dispersion is narrower than ERP because the platform is standardized. The economic discipline is to scope tightly to required services, hold the implementation partner and the tooling vendor to fixed fee, and avoid scope expansion driven by tool capability rather than Newco operating need.
The most common cost overruns trace to third-party integration re entitlement effort, custom SharePoint solutions that did not migrate cleanly, and Power Platform apps that were not inventoried. The fix is the disciplined inventory before contract signing, the early outreach to third-party application owners for re entitlement quotes, and the change control process that prices every scope addition in writing. Where these controls are in place, the program lands within the original budget plus or minus 10 percent.
The most common timeline overruns trace to delayed DNS coordination, late confirmation of co existence requirements, and slow third-party application re entitlement. The fix is the explicit dependency map maintained by the PMO with named owners on both sides and a weekly governance rhythm that escalates blocks within 48 hours. Productivity services touch every employee daily. Delays propagate to morale and productivity.
A clean Microsoft 365 separation produces a Newco that runs its own tenant with licensed entitlements, supported configurations, and the optionality to evolve the productivity stack on Newco timeline. The discipline runs through the TSA exit acceleration program and is delivered under a Fixed Fee + Portfolio Retainer engagement model.
Public cloud account decoupling, billing transfer, IAM rebuild, and the network boundary.
Read the article →Salesforce org separation, data export, customization migration, and integration redesign.
Read the article →The cross platform IT separation framework and how to sequence the workstreams.
Read the article →The 90-day governance, IT, finance, HR and procurement separation plan we run on live carve-outs. Get the playbook plus the bi-weekly Day One Letter — short, signal-heavy, buyer-side.
No spam. Unsubscribe in one click. · Read the overview first →
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Seven buyer-side moves to exit a Transition Services Agreement on time and below budget. The mark-up, the extension-fee curve, exit sequencing, and the 11-month calendar.
One tactic, one benchmark, or one pattern from a recent buyer-side engagement. Short. Signal heavy. Free.
Subscribe to The Day One Letter →Treat the email-domain and tenant split as a project, not a switch. Rushed cutovers lose mail, files and identity links you cannot get back.