TSA Exit Acceleration
Off the seller’s Mimecast tenant. With the archive intact.
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Mimecast TSA separation is the work of standing up a Newco tenant, rebuilding the email security and routing policy, deciding what happens to the archive, and cutting Newco's mail flow through Newco's own gateway before the seller's tenant still scans or holds Newco mail. The work sits inside the broader carve-out advisory program and is sequenced with the email domain migration, because mail routing is a Day One dependency for every user.
Mimecast separation starts with an inventory of the seller tenant. The buyer needs the subscription scope across the email security gateway, targeted threat protection, the archive, continuity, and any awareness or sync and recover modules, the routing configuration that places Mimecast in the mail flow, the policy set for spam, malware, URL and attachment protection, and the volume and retention scope of the archive that holds historical mail.
The archive is the decision that shapes the whole separation. The archive holds years of historical email that may include Newco records under legal hold and regulatory retention. The buyer decides whether Newco's historical mail is exported and migrated to a Newco archive, whether a portion is retained by the seller under defined access, or whether the archive is split. This decision drives effort, cost, and timeline more than the gateway cutover does.
The clean end state is a dedicated Newco tenant with its own gateway, its own policy, and a defined disposition of the historical archive. A shared seller tenant keeps Newco mail under seller scanning and seller visibility, which is unacceptable beyond a short bridge. The gateway sits in the mail flow, so the routing change is a coordinated cutover rather than a quiet background move.
Target strategy ties Mimecast to the email domain migration. Because Mimecast routes mail for the domain, the tenant and routing cutover are sequenced with the domain and the underlying mailbox platform so the mail flow lands cleanly. The archive disposition runs in parallel on its own track because of its volume and legal sensitivity.
Mimecast is sold per user across module bundles, with the archive priced on retained volume and retention period. The seller agreement does not transfer in a carve-out. Newco signs a direct subscription sized to its real user count and the modules it needs, rather than inheriting a bundle and an archive scope built for the combined organization.
A carve-out reads to the vendor as a buyer with a Day One deadline, which is real leverage on the sell side. The buyer offsets that by opening the commercial conversation early and by separating the Day One routing need from the archive migration, which can run on a longer track. Where Newco is reconsidering its email security architecture, a credible alternative strengthens the position, though Day One mail flow usually argues for continuity first.
Where the seller provides email security and archive access through a TSA window, the pricing is cost-plus or fixed-fee with a defined exit ramp, and the TSA states how Newco users and archive access are metered. The archive deserves explicit treatment because the seller may hold Newco's historical mail, and the TSA must define export rights, format, and the access window.
Where a partner is engaged for the archive export and migration, the contract is fixed fee for defined deliverables with disciplined change control. The subscription and archive audit runs through the broader TSA license consolidation work so Newco right sizes its email spend at exit.
The email security policy is rebuilt rather than copied wholesale. Spam and malware policy, targeted threat protection for URL and attachment, impersonation protection, data loss prevention, and the allow and block lists are reconstructed in the Newco tenant to match Newco's risk posture. The seller policy is a useful reference, but it carries seller specific senders, exceptions, and allowlists that Newco reviews rather than inherits.
Routing is the heart of the cutover. Mimecast sits in the mail path through the inbound and outbound connectors and the published mail exchange records. Newco's inbound routing is pointed at the Newco tenant, the outbound connectors from the mailbox platform are repointed, and the mail exchange records for the domain are updated so mail flows through Newco's gateway. This is coordinated tightly with the domain and mailbox migration so the flow is never broken.
Continuity and the emergency mail features are reconfigured for Newco so that if the mailbox platform is unavailable, Newco users still send and receive through Mimecast continuity rather than the seller's. The buyer confirms the continuity configuration points at Newco infrastructure and not the seller's.
Allow and block lists and impersonation protection are validated against Newco's real sender estate so that legitimate mail is not quarantined when the flow moves to the Newco tenant. The discipline mirrors the broader email domain migration sequence so the security and the routing land together.
The archive workstream is where Mimecast separations succeed or stall. Newco's historical mail is identified within the archive, exported in a defensible format, and ingested into the Newco archive, with chain of custody preserved for anything under legal hold. Where the archive is jointly held, the split is defined by mailbox and by date so that Newco's records move and the seller's remain, without either side losing a record under retention.
Journaling is repointed so that, going forward, Newco's mail is captured into the Newco archive rather than the seller's. The journal configuration on the mailbox platform is changed to deliver to the Newco tenant at the same time the routing cuts over, so there is no gap in capture for compliance.
Identity integration binds the tenant to Newco's directory. Mimecast authenticates administrators and provisions users against the identity provider, and directory synchronization is pointed at Newco's directory so that user accounts, groups, and policy assignment resolve against Newco identity. The user provisioning and single sign on are gated on the identity boundary being live.
Retention and legal hold settings are reconstructed in the Newco tenant so that Newco's compliance obligations carry forward. The buyer confirms that no Newco hold lapses during the migration and that the retention clock on Newco records is preserved rather than reset.
Cutover moves the mail flow and the journal to the Newco tenant. The runbook covers the inbound routing change, the outbound connector repoint, the mail exchange record update, the journal redirection, and the validation gate, sequenced with the domain and mailbox migration so mail is never lost in transit. The cutover is timed to a low volume window where the business allows it.
Validation confirms continuity. Inbound mail is tested through the Newco gateway, outbound mail is confirmed to route through Newco, security policy is confirmed to scan without quarantining legitimate senders, journaling is confirmed to capture into the Newco archive, and continuity is tested. Because mail flow is a Day One dependency, the routing is validated on a pilot group before the broad cutover.
Stabilization runs thirty to sixty days. Misrouted mail, quarantined legitimate senders, and policy false positives are triaged within agreed service-level commitments. The archive migration continues on its track and is reconciled so that the count and the date range of migrated records match the source.
Decommissioning is explicit. Once Newco operates on its own tenant with its mail flowing and its archive migrated, the seller removes Newco users and routing from its tenant, stops journaling Newco mail, and confirms that Newco mail no longer flows through or is held by the seller's Mimecast account, subject to any agreed retention window.
Mimecast separation cost is driven by user count, the modules Newco subscribes to, and above all the archive volume and migration effort. The discipline is to right size the user count and modules and to scope the archive migration precisely to Newco's records rather than moving the whole shared archive. An archive scope built for the combined organization is both a migration cost and a recurring storage cost the separation should correct.
The common failure mode is treating the archive as an afterthought. The gateway cutover is a defined event, but the archive holds years of records under legal hold and retention, and a migration scoped late or executed without chain of custody puts Newco's compliance position at risk. Buyers that start the archive disposition early, in parallel with the routing work, avoid a stalled exit.
The second failure mode is breaking the mail flow at cutover. Because Mimecast sits in the mail path, a routing change made out of step with the domain and mailbox migration drops mail. The fix is to sequence the routing, the journal, and the mail exchange records as one coordinated cutover. A PMO maintains the dependency map across Mimecast, the domain, the mailbox platform, and identity, escalating blocks inside forty eight hours.
A clean Mimecast separation produces a Newco that owns its own tenant, its own mail flow and policy, and its own archive of record, with its compliance obligations intact. The discipline runs through the TSA exit acceleration program under a Fixed Fee plus Portfolio Retainer engagement model.
Yes. The clean end state is a dedicated Newco tenant with its own gateway, policy, and a defined disposition of the historical archive. A shared seller tenant keeps Newco mail under seller scanning and seller visibility, which is unacceptable beyond a short bridge.
The archive is the central decision. Newco's historical mail is exported in a defensible format and migrated to a Newco archive, or the archive is split by mailbox and date where it is jointly held. Chain of custody is preserved for records under legal hold, and retention clocks are carried forward rather than reset.
Mimecast sits in the mail flow through the connectors and the mail exchange records, so the routing cutover has to be sequenced with the domain and mailbox migration. A routing change made out of step with the domain drops mail, so the two are coordinated as one event.
The Newco tenant and routing cutover can be ready in weeks once the domain plan is set, but the archive export, migration, and reconciliation usually extend the full separation to two to five months depending on archive volume and legal hold scope.
Tenant split, email protection and TAP rebuild, archive disposition, and the routing cutover.
Read the article →The domain and mailbox split that the email security cutover is sequenced against.
Read the article →The Day One security control set and where email security fits the plan.
Read the article →The 90-day governance, IT, finance, HR and procurement separation plan we run on live carve-outs. Get the playbook plus the bi-weekly Day One Letter — short, signal-heavy, buyer-side.
No spam. Unsubscribe in one click. · Read the overview first →
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Seven buyer-side moves to exit a Transition Services Agreement on time and below budget. The mark-up, the extension-fee curve, exit sequencing, and the 11-month calendar.
Exit the seller's security stack first. Every week of shared security is a week of shared blast radius on a business they no longer own.
One tactic, one benchmark, or one pattern from a recent buyer-side engagement. Short. Signal heavy. Free.
Subscribe to The Day One Letter →