HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Identity & access

How do you consolidate multiple Active Directory domains?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

Pick one target domain, build a trust from each source, then move users, groups, computers and servers in waves while SID history preserves access to old resources. Keep Entra ID sync matched to the same cloud accounts throughout. For some organizations the better answer is not to merge AD at all, but to move to cloud identity and retire the extra domains.

Key facts

  • Consolidation needs a target domain, trusts, and a plan for SID history and resource permissions.
  • ADMT is legacy and not actively developed; many projects now use commercial migration tools or scripted moves.
  • The Entra sync source anchor must stay consistent so moved users keep their Microsoft 365 accounts.
  • Service accounts, SPNs, GPOs and DNS cause more issues than user accounts.
  • After an acquisition, cloud-only identity can be faster than merging forests.

Why consolidate, and when not to

Multiple domains usually come from acquisitions, old regional designs or legacy security boundaries. They mean more domain controllers to patch, more trusts to secure, duplicate accounts and confusing access.

Before planning a full AD merge, ask whether AD needs to survive at all. If most apps are SaaS and devices can move to Entra join and Intune, it is often cheaper to bring acquired users into your Entra tenant, move their devices, and retire their domain, without migrating AD objects at all.

Planning the target

  • Choose the target domain and confirm it is healthy: replication, DNS, functional level, time sync and backups.
  • Decide the naming standard for users, groups and computers, and the OU structure in the target.
  • Map UPN suffixes so users keep sign-in names that match their email.
  • Inventory each source domain: users, groups and nesting, computers, servers, service accounts, SPNs, GPOs, DNS zones, certificates and applications.
  • Identify which groups protect file shares, SQL databases and apps, since these drive the SID history plan.

The migration approach

StepWhat happens
Trusts and DNSCreate trusts and conditional forwarders between source and target
GroupsMigrate groups first, with SID history, so permissions still resolve
UsersMigrate users in waves with SID history and passwords; keep attributes like mail and proxyAddresses
ComputersRejoin workstations to the target domain and translate local profiles, or reprovision
Servers and appsMove member servers, update service accounts, SPNs and app configs
Permissions cleanupRe-permission resources to target groups, then remove SID history
DecommissionRemove trusts, demote source domain controllers, clean DNS

Keeping Microsoft 365 in step

If users in the source domain sync to Entra ID, moving them to another domain can create new cloud accounts or orphan existing ones unless you plan it. The sync tool matches on the source anchor, commonly the ms-DS-ConsistencyGuid attribute. Copy that value to the migrated user object so Entra Connect or Cloud Sync matches the same cloud account, mailbox and OneDrive.

Test this with a few pilot accounts before any wave. Check that the cloud object stays the same, licenses remain, and sign-in works with the expected UPN.

Tools

The Active Directory Migration Tool is the traditional free option, but it has not been actively developed for years and has limits on newer systems. Many projects now use a commercial AD migration tool, which adds better reporting, rollback and device profile handling, or scripted moves for smaller estates. The right choice depends on object count, the number of servers and how much rollback you need.

How Accred Consulting approaches it

Accred Consulting starts with discovery across every domain: health, trusts, object counts, group nesting, service accounts, GPOs and how each domain syncs to Entra ID. We then recommend a full merge, a partial merge or a move to cloud identity, with reasons. The proposal gives scope, waves, a fixed price and a timeline. Our US-based specialists build trusts, migrate groups, users, devices and servers with SID history and matched source anchors, and check in after each wave. At handover you get documentation of the target design and cleanup steps, with optional support while source domains are retired.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

Small consolidations with few servers can take weeks. Larger ones with many servers, apps and sites take months, mostly because of application testing and device moves. A realistic schedule depends on what discovery finds and is set after it.
Not if groups are migrated with SID history first and resources are re-permissioned before SID history is removed. Users keep access to old resources through the trust while the move is in progress.
Often yes. If the acquired company's apps are mostly cloud-based, you can sync or create their users in your Entra tenant, move their devices to Entra join with Autopilot, move their data, then retire their domain. This avoids trust and SID history work entirely.
GPOs do not move with users and computers. Export and review each source GPO, rebuild what is still needed in the target domain or in Intune, and drop the rest. Link new GPOs before computers move so devices get the right settings on their first restart in the target domain.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation