Mergers · Acquisitions · Divestitures

Your next deal closes on a date. Make identity ready for it.

Every deal ends in the same task: hundreds of SSO applications that have to work in another identity tenant on Day 1. TenantFlex discovers them, flags what needs a human decision, and migrates the rest between Entra ID, Okta and PingOne, with an audit trail for every step.

Request a demo

Microsoft Entra IDOktaPingOneadditional IdPs on request

Three shapes of deal

One workflow, whichever way the applications are moving.

Acquisition

Bring the acquired company's applications into your tenant, on your provider, with their claims mapped to your directory.

Merger

Consolidate two tenants onto one provider. Both sides' application owners see settings they recognise, read back from the destination.

Divestiture

Carve a business unit's applications out of a shared tenant into a new one, often at the same provider, without touching what stays behind.

Acquisition or mergerThe target's applications end up in the acquirer's tenant, on the acquirer's provider, with claims mapped to its directory.

DivestitureA business unit's applications move to the new tenant with their certificates, claims and owners. What stays behind is not touched.

Why it takes months by hand

Each application means copying SAML settings, redirect URLs, claims and secrets into the new tenant one setting at a time, and then waiting on the application owner to test. Multiply that by the application count and the elapsed time is set by calendars, not by the work.

How it works

Discover, review, migrate.

Connect both tenants read-only. The same workflow runs for every pair of providers, including two tenants of the same one.

Discover

Connect an identity provider tenant in read-only. TenantFlex inventories its SAML and OAuth/OIDC applications, service principals, credentials and their expiry. You see what is really there, not what the CMDB says.

Review

Approve what is in scope, set naming and credential handling, and get suggestions for complex claims transformations. Nothing migrates until it is approved.

Migrate and hand off

Each application is recreated in the target tenant, read back and compared with the source, then handed to its owner for cutover. If one fails, the job rolls back what it created.

Verified, then handed offEvery setting is read back from the destination and compared with the source. A claim without a clean match is mapped and flagged, then each owner receives a hand-off bundle. The source tenant is read-only throughout.

Claims

Claims mapped through one vocabulary.

Each provider writes the same claim in its own form: ${user.email} in Okta, user.mail in Entra ID, email in an OIDC token. TenantFlex maps every source claim to one canonical name, based on a central user profile, and writes it in the destination provider's own form.

Claims without a clean match are given a suggested transform, with a confidence score and a check on sample users, and marked for review.

Working back from Day 1

Discovery at signing. Cutover on the day.

Pricing

Pay for the applications you move, or hand the whole thing to us.

Licensed per application in scope. Discovery tells you the number before you commit.

Two ways to engage.Take the platform, or take the platform and the people.

Licensed per application

You license the platform by the applications in scope, not by user count or tenant size. Discovery tells you that number before you commit. SaaS or deployed in your own environment, the same release either way.

Self-service

White-glove migration

We run it with you: scoping, the claim and policy decisions that need a human, a cutover plan per application, and the hand-off to each application owner. You get the platform and the practitioners who have done these migrations by hand.

With consultancy

Standby and the privileged access review are priced separately.

Pricing →

Get started

Tell us about your deal.

Source and target providers, roughly how many applications, and the date. We will walk you through a live migration.

[email protected] · www.tenantflex.com