Speakers:
Harry – Pre-Sales, Microsoft 365, Azure & Modern Work, Valto
Rob Thomas – Head of Azure & Microsoft 365, Valto
[00:00:00] Harry:
Thanks for joining us today. We’re here to dive into the IT and Microsoft ecosystem side of mergers and acquisitions.
When two organisations merge, the Microsoft environment almost always ends up sitting right at the centre of the integration. That’s identity, email, collaboration, data, all of it.
Getting that right is one of the most technically demanding parts of the whole process. It’s also usually one of the parts that gets the least attention early on because everyone is so focused on the commercial side of the deal.
I’m Harry, and with me today is Rob, who leads our migration practice here at Valto.
Over the next 20 minutes, we’re going to take you through the IT side of mergers and acquisitions properly: the security stakes, the tenant strategy decisions, and what a well-run migration actually looks like in practice.
So, you’ll know what good looks like whether you’re working with us or not.
[00:00:54] Rob Thomas:
Thanks, Harry. The short version is that no two Microsoft environments ever look alike going into these mergers and acquisitions engagements.
Different Azure AD structures, different licensing, different security policies, and different ways SharePoint and Teams have been configured over many years.
When two tenants need to become one, you’re not just moving data. You’re reconciling all of that, usually on a timeline you didn’t set and with people watching closely to see whether IT can actually deliver it.
That’s what we’re unpacking today, step by step, starting with why this is happening so much right now.
I’m Rob Thomas. I’m Head of Azure and Microsoft 365 here at Valto. I’ve been with the organisation for 10 years. My background is over two decades within the IT space, specifically around Microsoft.
I currently head up the Microsoft 365 and Azure practice within Valto. I work quite closely with sales, pre-sales and consultancy, right through to delivery and managed services. I set the strategic goals of the business unit.
[00:02:12] Harry:
And I’m Harry. I’m part of the pre-sales team at Valto for Microsoft 365 and Azure, as well as Modern Work, sitting within Rob’s team.
I work quite closely with the consultants throughout the pre-sales discovery and assessment process, and then almost act as an account manager when it comes to project and migration work.
[00:02:38] Harry:
Before we get into the IT side of it, it’s worth pausing for a couple of minutes and looking at why this is happening at all, because it isn’t random and it isn’t a short-term blip.
There’s quite a lot of recent research, specifically on financial services, that lays this out quite clearly. It’s worth sharing because it’s the sharpest example of a much bigger pattern.
[00:03:01] Rob Thomas:
It really is. Financial services and wealth management alone saw around 349 acquisitions in 2025. In the industry, that was up 26% on the previous record, and around 86% of those were backed by private equity.
That’s not a one-off. That’s a structural wave.
When you dig into why, there are a handful of pressures stacking on top of each other that are contributing to this growth.
The main one we’re seeing, and not just in financial services, although it’s very prominent here, is rising compliance and technology costs. They’re squeezing these mid-sized firms’ margins to the point that they can’t fund the technology investment alone.
Then there’s a huge amount of capital sitting with private equity and institutional investors. They’re looking for stable, recurring-revenue businesses to roll up. These predictable, fee-based incomes make for an attractive long-term platform.
Underneath all of that, there’s probably a demographic problem.
A large share of owners of these mid-sized firms, or even financial advisers and small franchisees outside of financial services, are heading towards retirement with no internal successor.
A sale can become the only real exit for these organisations, and one client succession problem becomes another firm’s growth strategy.
It’s something we’re very close to with our customers.
They often ask us whether we know what’s going on in the industry. Being so close to mergers and acquisitions across a multitude of sectors, we do have some insight because we’re working so closely with these organisations all the time.
There are lots of other things as well, including macroeconomic factors, interest rates, inflation and the margin compression that we mentioned.
It’s also really competitive. A lot of these equity firms are trying to buy out mid-sized firms to strengthen and grow their portfolios and customer bases.
We’re very much amongst all of that as well, which is very interesting.
[00:05:41] Harry:
Like Rob said, none of that is specifically unique to financial services.
Swap advisers for any professional or specialist business with an ageing owner base, rising compliance costs and clients wanting more integrated services, and you get a similar picture in legal, healthcare, professional services and some parts of manufacturing as well.
That’s really why we’re spending more time on this right now. Analysts aren’t calling it a short-term cycle, they’re calling it structural.
That means the IT side of it, and what we’re going to cover today, isn’t going away either.
Let’s get into the technical detail a bit more, starting with the basic reality of what you’re dealing with when two Microsoft environments come together, Rob.
[00:06:28] Rob Thomas:
The starting point is that no two environments ever look the same.
One tenant might have Entra ID cleanly structured, with Conditional Access enforced everywhere and really strong identity controls.
Another might have grown organically for years with nobody revisiting the configuration.
Merging them isn’t just moving data from A to B. It’s reconciling the structure, the policy and years of accumulated decisions.
It’s not just technical work either. One of the biggest things is stakeholder management.
Each environment has its own IT team, its own way of working and its own attachment to how things are set up. You’re navigating cultures as much as systems.
That’s especially true when it’s not just two organisations coming together. Quite often in our customer base it’s several at once. When I say several, it could be thousands of franchisee firms, or perhaps 50 medium-sized organisations being absorbed by a larger group.
That complexity looks different depending on the industry as well.
We’ve talked about financial services because it’s happening a lot there. Environments are often tightly locked down, with regulatory data-handling policies, retention rules and sometimes FCA-related configurations baked directly into the tenant.
You can’t just copy and paste the setup. You have to map both organisations’ compliance requirements onto a single framework and prove you’ve done it properly.
In legal, the sensitivity can be even more granular. Client matter files are often privileged, with confidentiality controlled at an individual level. Migrating data incorrectly isn’t just an IT slip, it can become a professional conduct issue that follows a firm for years.
If we think about manufacturing, you’ve usually got deeper integration with ERP systems and sometimes OT systems as well, alongside lots of on-premises environments.
SharePoint might be holding engineering documentation and supplier contracts. Teams could be running shop-floor communications.
You can’t look at the tenant in isolation. You have to protect absolutely everything it’s connected to before you touch anything.
Technically, there’s a lot to go through.
[00:09:20] Harry:
Yeah. The shape of the problem always seems to be the same, but the details change completely depending on who you’re merging with and what that environment looks like.
[00:09:32] Rob Thomas:
One hundred percent. No two organisations are the same.
A lot of people are trying to get to the same end goal. It’s all about compliance, structure and moving things over.
It’s about having a solid methodology, or a portfolio of methodologies, that can match these industries and help them migrate.
[00:09:52] Harry:
Amazing.
Security is typically where we always start because it’s the part that can get treated as a footnote, when actually it should be right at the top of the list in our eyes.
[00:10:05] Rob Thomas:
Definitely. It’s one of the most critical windows in an organisation’s security posture and probably the most overlooked.
Merging companies often means new users, new devices, elevated guest access and often partially connected environments. This is exactly what threat actors look for because everyone’s attention is potentially elsewhere.
Especially when more prominent organisations are going through mergers and acquisitions, they quite often make it into press releases, LinkedIn and similar channels. It’s really easy to find these opportunities.
Again, that security is really important. It’s also exactly the moment that organisations are most distracted because everyone is focused on the business integration.
Sometimes security quietly slips down the priority list until something goes wrong, which is precisely when it needs to be at the top of that list.
Before any data moves, we baseline both environments.
We look at having a strong identity baseline, Conditional Access, MFA enforcement and proper external sharing settings. We review anything that might now become a real risk in the combined entity or entities.
We also use identity governance to check who actually has access and whether stale accounts have been cleaned up.
We look hard at the Entra ID architecture itself because that’s the foundation everything sits on. If that’s wrong, every migration decision built on top of it inherits the same problem.
Sensitivity labels should be applied before migration as well, not after, so data is classified correctly from the moment it lands in the new environment rather than being retrofitted later.
The most common gap is probably overly permissive external sharing, along with years of guest access for suppliers and contractors that’s never been reviewed.
Sometimes there are hundreds of external accounts nobody has checked in years.
All of that needs rationalising before you bring the two environments together and migrate the identity settings. Now is also the time to have a proper review of all those things.
[00:12:46] Harry:
Yeah. Even before people get to security, there’s the tenant strategy decision itself.
You need to decide which tenant survives, perhaps, or whether you build something brand new. That has to happen quite early on as well.
[00:13:01] Rob Thomas:
Yeah, definitely.
[00:13:03] Harry:
Amazing. Let’s talk about that decision because it’s one of the most important calls in the whole project: the three tenant strategies.
[00:13:12] Rob Thomas:
Quite commonly, there are three options.
You can keep the acquirer’s tenant and migrate everyone into it. That’s usually right when one environment is clearly bigger, cleaner or better governed than the other.
It’s often the fastest and cheapest route because you’re not starting from zero.
You can build a greenfield tenant from scratch. That tends to suit a genuine merger of equals, or a case where both existing environments are far enough from the desired state that starting fresh is actually less work than untangling either of them.
It costs more upfront, but you avoid inheriting anyone’s legacy mess.
You can also run a managed multi-tenant setup, keeping both environments running and connected rather than merging them outright.
That buys time when the business itself hasn’t decided how integrated it wants to be yet.
Cost, complexity and risk differ across all three. The right answer really depends on the size of both organisations, the state of the environments and the long-term strategy.
It’s rarely purely a technical decision.
That’s where we’ve seen some of the horror stories. If you get that decision wrong early, you can be left unpicking it for years.
It’s definitely worth taking the time to get it right before anything technical even starts.
[00:14:54] Harry:
Yeah, definitely.
On that last point about multi-tenant environments, it’s worth diving deeper because it’s more common than people think, especially in the conversations we have.
Would you say it’s a bit misunderstood at times?
[00:15:12] Rob Thomas:
Yeah, definitely. It really is more common than people think.
A group might hold five or six businesses that operate entirely independently, with different brands, different customers and even different regions.
Full consolidation into one tenant may not make sense yet, especially if the technology stacks are still being reconciled and reviewed by leadership and IT.
In those cases, separate tenants with good cross-tenant collaboration can be the right interim answer, sometimes for a year or two while the wider integration strategy settles.
Microsoft gives you some good tools for that. Cross-tenant access settings in Entra ID control how users from one tenant interact with another.
Teams shared channels let people collaborate without the full overhead of guest accounts, and some organisations layer third-party tools on top for a more unified view across the group.
But it’s more work than running a single tenant. You’ve got two policies, two compliance configurations, two admin teams and sometimes two different sets of licensing agreements to manage.
The real risk is drift, where one tenant gets updated or hardened and the other doesn’t, quietly widening the security gap between them.
Multi-tenant is completely legitimate as a strategy. A lot of our customers adopt that model, but only if it’s deliberate and actively managed, with someone accountable for keeping all sides aligned.
It shouldn’t just become the default because nobody got around to consolidating.
[00:17:03] Harry:
Yeah. Even then, I think it’s worth keeping a consolidation roadmap in the background.
[00:17:10] Rob Thomas:
Mhm.
[00:17:10] Harry:
If the setup was built cleanly, pulling it together later is much easier. But, like you mentioned, if it’s drifted, it becomes an expensive archaeology project.
[00:17:22] Rob Thomas:
Yeah, one hundred percent.
[00:17:25] Harry:
It’s worth going into what actually working with us looks like.
Typically, there are five stages from start to finish.
We begin before an engagement is even confirmed, with pre-sales education and a proper look at scope, complexity, timeline and resources.
We’d rather have that conversation upfront than discover misaligned expectations six months in, which is something we’ve heard about in other horror stories in recent years.
We treat this as a discovery and assessment process covering identity, Exchange, SharePoint, Teams, devices, licences, the lot.
Every discovery turns up things that nobody expects. That might be shared mailboxes from projects that finished years ago, SharePoint sites with hundreds of stale external guests, licences assigned to accounts that haven’t logged in for over a year, or security groups that no longer reflect the current organisational chart.
What we find shapes everything that follows, because you can’t plan a migration properly around an environment you don’t actually understand.
From there comes a workshop stage, and this is probably one of the most important things we do and recommend.
This is where those decisions come into play: which tenant survives, how users migrate, the approach, what happens to legacy content and how the new environment gets governed.
These aren’t purely technical decisions. They have real business value and sometimes legal implications.
We put the right people in the room, making sure IT, department heads and sometimes finance or legal are there too. We make the decisions together and create that roadmap.
People who help make a decision are far more likely to own it and defend it when things get difficult further down the line.
After that comes the project itself, where the migration is executed against the plan everyone agreed to and the roadmap they helped build.
Then comes stabilisation, with proper post-migration support before we call the project closed. It’s not just a quick check and a handshake.
Is there anything on stabilisation or post-migration support that you’d add to that, Rob?
[00:19:58] Rob Thomas:
Yeah. We’ve got quite a mature delivery model for mergers and acquisitions, tenant consolidation and migrations.
Hypercare is always something that’s built into these engagements from go-live.
There’s always going to be some disruptive element for users. They’re logging into new systems, and each customer has its own line-of-business applications and things like infrastructure hosted in Azure or the Power Platform.
The hypercare is tailored towards the customer and their requirements, including the size of their team and whether we need to add engineers or boots on the ground to really help with that go-live.
Post-migration strategy, especially in a multi-tenant environment, is also really important.
We provide some customers with toolsets that help them design things like security blueprints, which we work on together.
The customer can then use those toolsets to monitor, govern and keep those additional tenants secure.
That becomes an ongoing engagement afterwards, where we’re constantly ensuring the new platform is stable and that the customer has the right tools to manage it properly.
With these acquisitions, it tends to be an extended journey anyway.
Quite often, there are lessons learned and a continuous feedback loop into the next wave of acquisitions and migration projects.
If the project has come to a close, we work closely with transition managers, the internal service desk and service management to ensure users have the right level of support.
We also make sure the customer’s service delivery team has the right tools and knowledge to deliver that support post-migration.
To summarise, a lot goes into that post-migration piece. It’s not simply, “Your data’s moved over, job done, thank you very much.” There’s a lot more to it.
[00:22:37] Harry:
Yeah. All those stages are important, but I think it’s worth stressing that what we see as the particular pivot point is that workshop stage.
You get the right people around the table straight away, and everything downstream, in our experience, gets a little bit easier.
[00:22:55] Rob Thomas:
Mhm.
[00:22:57] Harry:
It’s probably worth closing the technical content by looking at what a well-run migration actually looks like in practice.
Taking everything we’ve just spoken about, regardless of the size of the project, what does it really look like when it’s done right?
[00:23:17] Rob Thomas:
First is phasing.
With our typical engagements, we never move everything over in one weekend. It’s higher risk and there’s no safe fallback if something breaks halfway through.
We phase by department or location, typically with pilot groups first.
It could be 20 to 30 users, for example, running through the entire process end to end before the wider rollout.
The pilot only works if you stress-test absolutely everything.
It’s not just whether the data moves. You need to know whether permissions are right, whether Outlook rebuilds properly with all the workflows that tie into how people work, and whether Teams channels are visible.
You also need to know whether the help desk scripts actually cover the questions people ask on the day.
On top of that, user communications need to be run as their own workstream. They should be in plain English and specific to people’s roles, rather than bolted onto the technical plan as an afterthought.
People cope with change far better when they know what’s happening and when.
It’s all about setting expectations with these engagements. You have to be absolutely open about everything and how things are going to run.
The rollback plan also needs to be fully documented and actually tested before the migration goes live. It shouldn’t be written after something has gone wrong.
A rollback plan that nobody has rehearsed can become little more than hoping for the best.
The strategy can change depending on the types of migrations you’re doing.
With really large financial services organisations, they may have smaller franchisees being migrated. Those could have between one and three employees or advisers.
The approach is then much smaller, but on a bigger scale.
That’s different from two large organisations merging together, perhaps two 500-seat organisations. That might follow the phased approach I’ve just described.
But it all starts with that discovery piece.
[00:25:48] Harry:
Yeah. With the pilot group especially, you have to be willing to act on what the pilot tells you. Otherwise, it can become wasted weeks or wasted time.
Going into our key recommendations, if there’s one section to remember from my side, it’s this: start the IT conversation first.
Discovery takes real time, and the earlier IT is involved, the more options you have.
Invest properly in user communications, like Rob mentioned, because it’s underestimated on almost every project we see.
Don’t skimp on stabilisation and support afterwards, including proper post-cutover support.
Choose a partner with both technical depth and real project management capability, so you keep those milestones going throughout. You need both.
And treat the whole migration as a governance reset. Aim to leave the tenant better than you found it, rather than simply moving everything.
Would you add anything to that, Rob?
[00:26:57] Rob Thomas:
If there’s a single takeaway, I would say start early.
Don’t wait until the merger has already gone through. I’d say a couple of months before, or as early in the planning process as possible.
Our smoothest migrations are always the ones where planning started well ahead of the transition.
The harder ones are the calls two weeks after completion, with the deadline already set before anyone has looked under the bonnet.
There’s no shame in getting specialists to help with this.
The cost of doing it poorly always outweighs the cost of doing it right.
There’s a lot of expectation when organisations are merging or when you’re acquiring a new business. It can be quite a delicate exercise.
I would say reach out to a partner like ourselves as early as possible.
[00:28:05] Harry:
Well, that’s everything we wanted to cover today.
Thanks for giving us half an hour of your time.
If you’re heading into a merger and acquisition process, or you’re already in the middle of one, feel free to come and talk to us.
We’ll give you an honest review of the scope during that discovery process and what good looks like for your situation. Just a proper conversation around it.
You can book that through our contact page, which you can see on the screen, or drop us a message on LinkedIn or via email.
We’ve also put together a tenant migration readiness checklist, so it’s worth grabbing whether you end up working with us or not. The link should be in the description.
[00:28:49] Rob Thomas:
If you want more of this kind of thing in the meantime, follow Valto, Harry or me on LinkedIn.
We’re posting regularly about mergers and acquisitions and Microsoft 365 migrations at the moment.
Our team is picking up more and more of these engagements, so we’re often sharing our experiences and some of our wins, including how we’ve helped companies.
Give us a follow on LinkedIn.
[00:29:22] Harry:
Thanks again for joining us, and thanks, Rob.
