Users
Name, title, department and phone numbers. New people are created; people who exist are updated; people who left the source are blocked from signing in, never deleted.
The directory arrives before the data does.
A migration needs somewhere to land: accounts, groups and contacts in the target, named the way the new organisation names them. MigrateX keeps Active Directory, Entra ID and Google Workspace in step — one direction, a preview before anything is written, and nothing ever deleted.
Any of the three, in either direction.
Each sync has one source and one target. Run two syncs if two directories need to feed each other different things.
Entra IDEntra IDTwo Microsoft tenants in a merger or a carve-out
Active DirectoryEntra IDOn-premises accounts created in the cloud tenant
Entra IDActive DirectoryCloud accounts given an on-premises counterpart
Google WorkspaceEntra IDLeaving Google for Microsoft 365
Entra IDGoogle WorkspaceLeaving Microsoft for Google
Active DirectoryGoogle WorkspaceA domain feeding a Workspace, and back
Active DirectoryActive DirectoryTwo forests: objects, OU structure, computer accounts
What is kept in step.
Groups and members
Groups matched by name, with members translated to their accounts in the target. Removing members is a switch you turn on, not a default.
Contacts
Mail contacts in Exchange Online, shared contacts in Google Workspace, contact objects in Active Directory — matched by address.
OU structure
Between two Active Directories the whole OU tree is recreated, parents first, so users and computers land where they belong.
Computer accounts
Between two Active Directories, computer accounts are pre-staged in the right OU, disabled, ready for the machine to join.
Sign-in name rules
Keep the name before the @, or rebuild it as first.last, jdoe or janed — on the target's domain or each person's own. Objects are discovered automatically; nothing is typed in.
Preview, then apply
Every run starts as a list: create, update, block, add member. Apply carries out exactly that list. A second run changes nothing that is already right.
On a schedule
Once a preview looks right, let it run every 15 minutes, hourly, every six hours or daily — through the months a coexistence lasts.
Networks that are not connected.
Two Active Directories in a merger rarely have a trust, a VPN or even a route between them. They do not need one. A small PowerShell agent in each network talks only to MigrateX, outbound, over HTTPS — and MigrateX carries the plan from one to the other.
- No inbound port, no trust, no VPN. The agent calls out; nothing calls in.
- One readable script using Microsoft's own Active Directory module. Read it before you run it.
- Read-only unless you say otherwise. A source domain's agent only reads. A target's agent applies the changes you approved, and only those.
- A token per agent, shown once, stored as a fingerprint, encrypted on the server with Windows data protection. Remove the agent and it stops working at once.
- Least privilege. Reading needs an ordinary domain account; writing needs rights delegated on the OUs you sync — not Domain Admin.
What it deliberately does not do
- Passwords are never read, sent or set. New cloud accounts get a random temporary password that must be changed at first sign-in; new Active Directory accounts are created disabled, without one.
- SID history is not copied. For a domain-to-domain move that needs it, run Microsoft's own migration tooling for that step once the objects are in place.
- Nothing is deleted. The strongest action is blocking sign-in for someone the sync itself brought over.
- One direction per sync. The target is never read back into the source.
- Printers are not copied. Print queues republish themselves from the print server in the new domain.
Preview your first sync in a few minutes.
Connect two tenants, pick what to sync and read the list. Nothing is written until you press Apply.