Entra ID how-tos
3 step-by-step Entra ID jobs with official downloads, exact clicks and checks.
At the end every user in your tenant will be required to use multifactor authentication, through either security defaults or Microsoft's documented Conditional Access policies, with two emergency access accounts that cannot be locked out and a campaign nudging users to set up Microsoft Authenticator.
14 stepsEntra IDDownload and install Microsoft Entra Connect SyncAt the end you will have Microsoft Entra Connect Sync installed on a domain-joined Windows Server, syncing the OUs you chose from Active Directory to Microsoft Entra ID with the sign-in method you picked.
11 stepsEntra IDSet up cross-tenant access settings in Microsoft Entra IDAt the end both tenants will have each other added as organisations in cross-tenant access settings, with the inbound, outbound, trust and automatic redemption settings that cross-tenant synchronisation and tenant-to-tenant migrations rely on.
8 stepsEntra IDPlaybooks that use these how-tos
Most organisations get to Entra ID in stages: sync identities, move sign-in to the cloud, move devices to Entra join, then shift management of users to the cloud. This guide covers each decision with the commands you will use.
18 min readHow to migrate from AD FS to Microsoft Entra IDDiscover every relying party, give users password hash sync or pass-through sign-in, pilot with staged rollout, move apps with the AD FS application migration wizard, convert your domains to managed, then remove AD FS and WAP the way Microsoft documents.
25 min readHow to move users and groups between Microsoft Entra tenantsMicrosoft Entra has no "move user" button. This guide shows how to use cross-tenant access settings and cross-tenant synchronisation for coexistence, how to turn synced accounts into real internal users when you migrate, and how to rebuild groups, licences, MFA and Conditional Access in the target tenant.
22 min readHow to apply the Essential Eight to Microsoft 365 after a migrationA migration is the right moment to set a security baseline. This guide maps each of the Essential Eight strategies at Maturity Level One to the Microsoft 365, Intune and Entra ID settings that Microsoft documents for it.
20 min readChecklistHow to migrate from Exchange Server to Exchange OnlinePick the right method for your Exchange version and mailbox count, set up hybrid or a cutover batch, move mailboxes and public folders, then switch MX and Autodiscover to Exchange Online.
24 min readChecklistHow to move Microsoft 365 from GoDaddy to a tenant you controlIf you bought Microsoft 365 through GoDaddy, there are two ways to end up with a tenant you manage directly or through another partner. This guide follows what Microsoft and GoDaddy actually document, and says plainly where the documentation stops.
16 min readHow to move mailboxes between Microsoft 365 tenants with cross-tenant mailbox migrationThe complete runbook for Microsoft's native cross-tenant mailbox migration: the licence, the migration app and consent, organisation relationships in both tenants, correctly stamped MailUsers, batches, completion and the day-one fixes for Outlook and mobile.
24 min readMicrosoft 365 tenant-to-tenant migration: the complete guideWhat a tenant-to-tenant move involves, which workloads Microsoft's native tools cover, the order to do the work in, the licences you need and how the domain cutover weekend runs. Each workload links to its own detailed runbook.
16 min readChecklistHow to migrate from Okta to Microsoft Entra IDFollow Microsoft's Okta migration tutorials in a safe order: take over user sync, give users a cloud sign-in method, rebuild Okta sign-on policies as Conditional Access, pilot with staged rollout, move app SSO, then defederate Microsoft 365 from Okta.
24 min readCommon Entra ID errors and fixes
All errors →InvalidSoftMatchEntra Connect tried to soft match an on-premises object to a cloud object that is already linked to a different on-premises object.
Entra IDAttributeValueMustBeUniqueA sync export failed because the mail, proxyAddresses, signInName or userPrincipalName value already belongs to another object.
Entra IDObjectTypeMismatchSoft matching found a user, group or contact of a different type with the same address.
Entra IDLargeObject: The provisioned object is too large. Trim the number of attribute values on this objectAn object exceeds an Entra ID size or count limit, most often because of too many userCertificate values.
Entra IDInvalidHardMatch: Hard match operation blocked due to security hardeningEntra ID blocked Entra Connect from taking over a cloud user because that user is protected.
Entra IDExisting Admin Role ConflictA synced user has the same userPrincipalName as a cloud user that holds an admin role, so Entra Connect will not soft match them.
Entra ID