Migrating to new CSP tenant

[Jinseng]

Is there a way to migrate CSP to a new O365 Tenant without having to move our entire Microsoft Partner Network information to the new tenant? The more we investigate how far reaching the MFA requirements and repercussions are for service accounts, guest accounts, equipment, 3rd party applications, etc., the more sense it may make to keep CSP in another tenant. I was not involved in setting up our CSP, so please excuse my ignorance. We wouldn’t want to pay for any O365 licensing in this CSP tenant. I imagine having user accounts that just have various levels of access to the CSP portal, and everything else MPN and application related (O365 Exchange, SharePoint, Teams, OneDrive, etc.) would stay in our existing tenant. We would also want to minimize the involvement/impact to our customers (It'd be best if they didn't even know about the change).  Is there a way to accomplish this?

[Lewis-H]

Create a new AAD tenant in AAD portal.
Create a new location in Partner Center for the MPN org. ...
Do the enrollment as CSP again with a user from this new tenant.
One the enrollment is confirmed (via email, after a few days) link the new enrollment to the MPN location ID from step 2.

[ChristianFUMEY]

But this will link the CSP to a NEW MPN ID.

I would like to always use my current Location's MPN ID, not a new one. How is it possible ?

[JanoschUlmer]

It should be possible to use an existing location ID that is already used, so skipping step 2 - although I recommend to use a new one to better differentiate between the different enrollments - and support has often advised to use new Location ID. Also there is an option later to update the MPN (Location) ID in the reseller profile to another ID in the same MPN org.

[ChristianFUMEY]

OK, I agree, and so

1. Step 8 is not to be run
2. We add a Step 10 : modify the MPN ID in Partner Center and
   1. if Indirect Reseller, at the Aggregator(s)
   2. if Direct ?

[JanoschUlmer]

Nothing specific required for Direct, at least nothing I can think of. 

[ChristianFUMEY]

Hello,

I think that the below scenario can be a little simplified

Reg. the question on splitting the tenant (Create new CSP Tenant):

1. Create a new AAD tenant in AAD portal

2. Create a new location in Partner Center for the MPN org. You can use the same organisation name as before, but there should be at least one different character in the org name (e.g. an additional "." at the end or use an abbreviation) - otherwise step 3 fails.

3. Do the enrollment as CSP again with a user from this new tenant

4. One the enrollment is confirmed (via email, after a few days) link the new enrollment to the MPN location ID from step 2

5. Send every customer a new CSP reseller invitation and let them accept it

6. If you are Direct CSP: Assign the same number & type of licenses again using the new CSP tenant, and immediately after that cancel/suspend all licenses in the old tenant (Licenses will be reassigned automatically); For Azure use the Transfer process.

If you are indirect: Check with the indirect provider if & how they need to update the records on their side.

7. If you are Direct CSP: Remove reseller relationship with the customer in the old CSP Partner Center

8. If you have customer you serve at Advisor, not as CSP, update the Partner of Record to the MPN Location ID (new Partner Center Tenant).

9. Contact Support and ask them to offboard the old tenant from CSP

Step 1 can be removed. It is now available via a ''Create New'' link at the beginning of step 2 if you need to create a new AAD tenant.

At the end of step 9, you have 2 tenants : one for CSP only and one for Production + MPN : how to migrate MPN to another ''primary'' tenant and keep current tenant for Production only ? (And, if needed, it will be linked in multi-tenancy).

I don't want to have to migrate any user to another new Production tenant and I would like to keep my vOrg MPN ID and Locations entries : is it possible ?

[Andra]

Hi @Jinseng ,

Regarding splitting a tenant, please see below the guideline.

While Microsoft does not have concrete guidance or tools to facilitate a split of one tenant to two separate tenants, this is certainly possible.  

Recommendation would be to move the internal production use to a separate tenant. To transfer data & configuration to the new tenant Partners would need to leverage 3rd party migration tools since Microsoft does not offer solutions for migrating data between tenants.  

Also, reseller relationship needs to be established again for every customer and all licenses would need to be exchanged for all customers (exchange means cancel/suspend the old licenses & provision new ones). 

Allow me to further check a few details, as proceeding to this process might cause other inconveniences.

I will get back on this thread.

Kind regards,

Andra

[jochenvangasse]

@Andra Do you have any updates on this? We too are looking to split up our tenant.

[Andra]

hi @jochenvangasse ,

Thanks for resurfacing this topic and apologies for the delay in my reply.

I discussed with my colleagues, below is what we know, so this more like a recap rather than an update. (:

Is there any particular blocker you are facing ?

The process is usually like this:

1. Create a new location in Partner Center MPN management

2. Create a new tenant (e.g. via Azure AD Portal)

3. Start the enrollment as Indirect or Direct Partner again, with a user from this new tenant - and then link this enrollment to the MPN org with the location ID created in step 1.

4. Invite customer to new tenant, re-provision licenses, transfer Azure subscriptions etc.

5. Open support ticket to discuss how to offboard the old tenant from CSP and/or Advisor

The issue is with step 2/3 - When Partner is using the exact same organisation name for the new enrollment/new tenant, the enrollment fails with a message that the "user is already onboarded to Partner Center" - even when trying with the completely new user from the new tenant.
The issue is actually not with the user, but with the organisation name. The trick is to make any small change in the name - e.g. append a point at the end, use an abbreviation (e.g. "Limited to "Ltd."). Note that the organisation name still needs to reflect the official/legal name of the company because of the subsequent business verification.

This issue is already known, but no ETA for a fix yet.

And of course - you should really think this through - splitting tenants is not an easy process, involves a lot of manual effort and takes time, especially when there are many customers.

Hope this helps,

Andra

[ZuluMike]

Hi.

Could you please explain in more detail number 3?

I'm not sure quite how long in the enrollment I got, but when i try to link enrollment to MPN org (associate tenant?) I get an error stating that the new tenant is already associated. Maybe I am completely off here, so if you could explain this process in more detail I would be very happy

[Andra]

Good day, @ZuluMike ,

Are you trying to split the tenants or enroll in the CSP program ?

Regrding the enrollment you can find more details here: https://docs.microsoft.com/en-us/partner-center/enrolling-in-the-csp-program.

Could you describe please what steps you take to associate the new tenant ?

Have you also checked in Partner Center the CSP dashboard for more information ?

At the bottom of that dashboard you have the option to get started - the enrollment in the CSP program.  please see below snip.

Andra

[ZuluMike]

Sorry for late response, did not get email when you replied.....

I got insecure of the process, because I did not get opportunity to link enrollment in the enrollment process, and I got afraid I did something wrong. But if I need to complete the enrollement first and then link it afterwards, I guess thats where my first issue is.

I have today one tenant that is "linked" to the CSP. My problem is that this tenant is also our production environment which means I have like 80 users pluss a lot of service accounts that will be affected by the new demands from Microsoft with mfa ++.

Therefore I would like to add a new tenant to use only for CSP. Since I have only 2 customers, I thought this process would be relative easy.....

I will try to complete the enrollment process first. But can you give me a hint on how to link this to the location i created in step 1 of your guide?

[Andra]

Good day @ZuluMike ,

For adding the location , please review this thread : https://www.microsoftpartnercommunity.com/t5/Multi-Factor-Authentication-MFA/Requirements-clarification-please/m-p/15459

mainly these instructions:

Reg. the question on splitting the tenant (Create new CSP Tenant):

1. Create a new AAD tenant in AAD portal

2. Create a new location in Partner Center for the MPN org. You can use the same organisation name as before, but there should be at least one different character in the org name (e.g. an additional "." at the end or use an abbreviation) - otherwise step 3 fails.

3. Do the enrollment as CSP again with a user from this new tenant

4. One the enrollment is confirmed (via email, after a few days) link the new enrollment to the MPN location ID from step 2

5. Send every customer a new CSP reseller invitation and let them accept it

6. If you are Direct CSP: Assign the same number & type of licenses again using the new CSP tenant, and immediately after that cancel/suspend all licenses in the old tenant (Licenses will be reassigned automatically); For Azure use the Transfer process.

If you are indirect: Check with the indirect provider if & how they need to update the records on their side.

7. If you are Direct CSP: Remove reseller relationship with the customer in the old CSP Partner Center

8. If you have customer you serve at Advisor, not as CSP, update the Partner of Record to the MPN Location ID (new Partner Center Tenant).

9. Contact Support and ask them to offboard the old tenant from CSP

Final Result is that in the old tenant you will still have Partner Center, but only for MPN management, and a new tenant with partner Center only for CSP.

Let me know if this helps.

Andra

[ChristianFUMEY]

Hello,

I would like to split my current unique tenant to two : the existing one to Prod+MPN, and a new one only for CSP. My MPN hierarchy is very simple : one v-Org (PGA) and only one Location (PLA, ex HQ).

If I follow the preceding 9 steps scenario, at the end my CSP MPN ID will be a new one, the one of the newly created Location.

How would it be possible to continue using my old PLA one? As this one is already linked as DPOR, PAL, DAP with no CSP customers, and to many other programs.

Could be a step 10 : In CSP Partner Center, change linked MPN ID from new Location to old PLA? I know this can be easily done, but what would be the following next steps?

I was also said to run your step 9 between 3 and 4, so that the current PLA ID is no more linked to CSP and could be linked to current PLA. This would also avoid to have to modify any MPN ID registered at Indirect Provider(s), but only to modify the tenant ID. Possible way?

Many thanks and best regards

[sreedwilson]

We have looked into this in the past. Andra is correct in all of the areas mentioned. It would be a manual migration with new licenses required and cancelations. It would be a very extensive, time consuming, and potentially error prone process.

[Jinseng]

Thank you for the confirmation. There’s clearly no straightforward/simple way of doing this, so I don’t think it’ll be an option for us. We use so much of the Office 365/Azure Platform that moving our corporate tenant is a non-starter. I’d be more inclined to move our CSP business to a new tenant, but that also sounds like a major undertaking.

[ivanrusso]

Does anyone have experience transferring the CSP business to a new CSP Tenant?

[jannickoeben]

Yes, we have almost finished. Just one customer to go.
It wasn't that bad to be fair.

1. Spin up a new tenant.

2. Enrol new tenant in CSP

3. Luckily, Microsoft Support helped us out by moving all the azure global (0145P) subscriptions from one CSP to the other, including creating reseller relationships.

4. Azure plan subscriptions we can now do through the portal and takes a few minutes per customer. Don't forget to add/replace the foreign principal! Also take into account Partner Earned Credits if you don't get them through DAP.

5. As for license based subscriptions, that was a bit tricky. We scripted our way through most of it using the partner center api by provisioning the same licenses and amounts through the new CSP as the old CSP, and after x hours deprovision the licenses from the old CSP. The tricky part is, there were some offers that are no longer being sold. That means looking for replacements, sometimes contacting customers. Luckily, this happened just for a handful of customers.

6. As for software, export all necessary keys as backup.