Cross-tenant Migration where a cross-tenant synchronization is enabled

Question

We're working on cross-tenant migration. There currently an MTO app performing a cross-tenant synchronization.

The synchronization includes organization relationships in each tenant and names the organizations in the organizationrelationship. It also has previously created the mail enabled users in the target tenant.

When creating the migration app and the organization relationship everything appears fine. Testing the app without a user shows it is ready. Testing with a user returns an error that the relationship does not have mail move enabled.

The organization relationship for the migration does have that enabled but shows the domain as the tenant id. The cross-tenant synchronization does not have that enabled and its domain setting is the tenant's domain.

It appears the two relationships collide when trying to migrate. Can these two applications work at the same time? Should the user be removed from the synchronization before migration? There appears to be a lot of little conflicts but no clear answers.

Answer 1

Hi @Deron J White

Thank you for posting your question in the Q&A Forum and sharing the details of your issue. 

Based on the information available from Microsoft documentation and community discussions, it appears that running cross-tenant mailbox migration alongside cross-tenant synchronization may sometimes lead to conflicts. 

This can happen because both processes rely on organization relationships (OR), but they may be configured differently, which can result in errors like the "relationship does not have mail move enabled" error when attempting a mailbox move. 

Here are some steps to help you resolve the issue: 

1. Confirm Settings in Both Relationships 

Use Exchange Online PowerShell to inspect the details of both Organization Relationships. 

• Verify that only the OR dedicated to migration has MailMigrationEnabled set to $true. 
• Note the exact domain value configured in each OR (e.g., one may be using the Tenant ID while the other uses a Verified Domain). 

If you find the domain identifiers are inconsistent (e.g., Tenant ID vs. Verified Domain), consider aligning them so both relationships reference the same domain value, as consistency often prevents these types of errors. 

2. Temporary Isolation Test (If Safe to Do) 

If operationally safe, temporarily exclude the user from the Cross-Tenant Synchronization scope, or pause the sync for that user. 

• Retry the migration for that user. If the move succeeds, this will confirm that a conflict exists between the two relationships. 
• Note: Please ensure you have approval and a rollback plan in place before making changes. Inform your change control or IT owner to avoid any unexpected disruptions. 

3. Align Domain Configuration 

If one OR references the Tenant ID and the other references the Verified Domain, it is best to align them so both relationships use the same domain identifier. If necessary, recreate the relationships with the correct domain setting to resolve the conflict. 

4. Log Review and Operational Planning 

Check Logs and Error Details: Collect and review the detailed migration error logs and any relevant synchronization logs. Look closely for exact error codes or specific attribute errors that could pinpoint a configuration error. 

Coordination and Scheduling: Since both sync and migration features must coexist, it is best practice to coordinate a migration window where synchronization is paused or limited for the specific accounts being migrated. 

Since we cannot directly diagnose your environment, I highly recommend reviewing these Microsoft resources for additional guidance. They offer specific steps to help verify prerequisites and troubleshoot common failures: 

• Troubleshooting Cross-Tenant Mailbox Migrations | Microsoft Community Hub 
• Synchronize users in multitenant organizations in Microsoft 365 - Microsoft 365 Enterprise 
• Cross-tenant mailbox migration - Microsoft 365 Enterprise 

I hope this helps, and please feel free to reach out if you need any further assistance or clarification.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

In a cross-tenant migration scenario where cross-tenant synchronization is enabled, it is important to ensure that the organization relationships are properly configured for both synchronization and migration. If you are encountering an error stating that the relationship does not have mail move enabled, it may indicate a conflict between the organization relationships used for synchronization and those used for migration.

Here are some considerations:

1. Organization Relationships: Ensure that the organization relationship specifically for migration has the mail move capability enabled. This is crucial for the migration process to succeed.
2. Domain Settings: The discrepancy in domain settings (tenant ID vs. tenant domain) between the synchronization and migration organization relationships could lead to conflicts. Make sure that the correct domains are set for each relationship according to their intended purpose.
3. User Synchronization: If the user is part of the synchronization process and is causing conflicts, it may be beneficial to temporarily remove the user from synchronization before proceeding with the migration. This can help to isolate the migration process and reduce potential conflicts.
4. Testing: Continue testing both the synchronization and migration configurations to identify any additional conflicts or misconfigurations that may arise.

Ultimately, both applications can work simultaneously if configured correctly, but careful management of the organization relationships and user synchronization is essential to avoid conflicts during the migration process.