How do you split a Microsoft 365 tenant for a divestiture or carve-out?

Key facts

• A divestiture is a tenant-to-tenant migration in reverse: one tenant splits into two.
• The transition service agreement (TSA) end date usually sets the hard deadline.
• Data scoping needs legal sign-off, since shared sites and mailboxes often hold content for both sides.
• The divested unit often needs a new tenant built first, with identity, security and licensing in place.
• Access to the parent tenant must be removed cleanly at the end, including guest accounts and app consents.

How a carve-out differs from a merger

In a merger, the goal is to bring everything together and the acquirer usually controls both tenants. In a carve-out, the parent company keeps its tenant and must give the departing business only what it is entitled to. Legal, HR and the deal team all have a say in what leaves.

The divested business may be going to a buyer with its own tenant, to a private equity owner that needs a standalone tenant, or to a new company built from scratch. Each changes who builds the target and who pays for licensing.

Scoping users and data

Start with people, then follow their data. HR provides the list of departing employees, and IT maps each one to a mailbox, OneDrive, group memberships and the sites and teams they use.

Shared content is where carve-outs get stuck. A finance site used by both sides, a shared mailbox handling customers of both, or a team mixing members from both companies needs a decision: copy it, split it, or keep it with the parent.

• Users, mailboxes, shared mailboxes and OneDrive accounts belonging to the departing unit.
• SharePoint sites and Teams owned by the unit, plus shared sites needing a split decision.
• Email domains and brands the divested business will keep.
• Line-of-business apps, Entra ID app registrations and enterprise apps the unit relies on.
• Devices enrolled in Intune that will move with departing staff.
• Content under legal hold or retention that the parent must keep regardless of the deal.

Building the target tenant

If the divested business needs a new tenant, build it before any data moves. That includes identity design and naming, Entra ID Conditional Access and MFA, licensing, Exchange Online settings, SharePoint and Teams policies, Intune enrollment and baseline security.

If the business is joining a buyer's existing tenant, the work looks like a normal tenant-to-tenant migration, but the source tenant owner is the seller. Both sides must agree on admin access, app consent for migration tools and change windows, which takes time to arrange.

Migration and the TSA

Most deals include a transition service agreement in which the parent keeps providing IT services for a set period. The TSA end date is the real deadline. Plan migration waves to finish well before it, with time left for cleanup and access removal.

Waves follow the same pattern as other tenant-to-tenant work: pre-stage mailboxes and files, run a pilot, move users in groups, then move the domain if the divested business keeps one. Cross-tenant mailbox migration, cross-tenant OneDrive migration and third-party tools are all options, chosen by workload.

• Restrict migration tooling to the in-scope users and sites, and log what is copied.
• Agree in writing which shared content is copied, split or left behind.
• Track TSA services, such as mail routing or file access, and when each ends.

Cutting off access cleanly

At the end, the parent removes the departing users and confirms nothing still connects the two companies. This step protects the parent's data and is often audited.

• Disable and later delete migrated source accounts, after converting mailboxes or preserving them for holds as required.
• Remove guest accounts, B2B access and cross-tenant access settings created during the transition.
• Revoke app consents and service principals used by migration tools.
• Remove the divested domain from the parent tenant after the final cutover.
• Wipe or reassign devices, and confirm Intune and Autopilot records are moved or cleared.

How Accred Consulting approaches it

Accred Consulting runs carve-outs as a joint project between the parent's IT team, the divested business and legal. Discovery maps users to data and flags shared content needing a decision. We build or prepare the target tenant, then migrate in waves timed against the TSA, with US-based specialists working directly with both sides. The proposal sets scope, a fixed price and a timeline. Handover documents what moved, what stayed and how access was removed, which supports audit and legal review.

Track record: 400+ client projects, 2,000+ migration workstreams and 150,000+ users migrated by a US-based team. Company facts · Case studies

Related questions