The challenge
A software vendor hosts one regulated application for seven utilities. Each gets its own farm, with its own SharePoint servers, SQL instance and batch server, because regulated case files do not share a database with another company’s. Six tenants alone account for 26 servers.
SharePoint 2016 sat underneath all of them, and Subscription Edition is where they had to go. That is not one migration but seven, each with a different change process, SSO team and view of what counts as validated. Any one can be scheduled; seven contend for the same engineers.
A fleet does not move as a fleet either. It moves one tenant at a time, so every tenant still waiting carries a second environment that must stay upgradable.
The solution
Readiness became a grid before any date was set. Eleven gates per tenant, from installation and DNS through firewall routing, SSL and SSO to trial migration and live upgrade. Six tenants against eleven gates is sixty-six cells, and the grid answers one question at a glance: which tenant is not ready, and for what.
Every tenant got a trial migration before it got a date. The live window in the plan is not an estimate but what the rehearsal took: three tenants at one day, one at 2.5, one at five and one at six. An average would have hidden that spread and pushed the six-day tenant into somebody else’s weekend.
The source farm was left readable. The first plan shut the old web front end down; the vendor asked for read-only instead. Both source databases are set read-only before the backup, then read-write on the new farm after restore. A shut-down source is a rollback you must rebuild; a read-only one you can still open.
One tenant migrated with a known gap, deliberately. Its workflow validation was unfinished when its window came up and regulatory data requests were landing the following week. It chose to migrate and work the issues afterwards, that decision recorded as the tenant’s, in writing, beforehand.
The results
Four utilities are on a platform with no support horizon, and the vendor now knows what its own upgrade costs: one day for a straightforward tenant, six for the difficult one. One window moved to 9 July because validation users needed longer. The date moved; the plan did not.
An instructive failure sits alongside it. In one tenant’s old environment a People Picker client secret expired on 20 May, renewal deprioritised because migration was weeks away. It cost users read access to past cases, and the investigation ran through a firewall theory and a certificate before reaching the secret. That tenant now asks for 30 days of notice before any certificate expires.
Two further environments joined in September on the client’s own infrastructure rather than the vendor’s platform, with production targeted at 1 December 2026. There the client’s DBA team holds the keys, and the build paused on one SQL setting the engineer could not make.