Execution state
- Connection, agent, job, stage, and item status
- Retries, skips, failures, warnings, and progress counters
- Pause, resume, cancellation, and recovery decisions
Platform
A governed control plane for identity and Microsoft 365 migration.
BridgeAD connects assessment, approved scope, operator action, on-premises directory execution, Microsoft Graph workload engines, reconciliation, and evidence without hiding capability boundaries or migration risk.
One program, specific enginesActive Directory executes through assigned outbound agents. Entra ID and supported Microsoft 365 workloads use approved Graph connections. Each workload retains its own scope, options, state, validation, and exclusions.
Operating model
Five stages. One decision trail.
Every stage has an owner, inputs, validation criteria, and evidence. BridgeAD is designed to make exceptions and rollback decisions visible instead of reducing migration to a copy button.
DiscoverConnections, topology, objects, dependencies.
PlanMappings, exclusions, batches, dry run.
ExecuteAgent commands, controlled jobs, recovery.
ReconcileCounts, failures, retry decisions.
ProveAudit records, exports, sign-off.
Program controls
Built around decisions migration teams make repeatedly.
Availability depends on the precise workload scope, permissions, tenant state, deployment, and engagement boundary. BridgeAD keeps those conditions attached to the jobs and evidence they govern.
- Connection validation
Source and target AD, Entra ID, Exchange, SharePoint, and Teams connections with explicit health and permission checks. - Assessment-backed scope
Inventory objects and content, review findings, select approved assets, and freeze the definition used for execution. - Identity mapping
Automatic, manual, and CSV mappings with collision checks and stable source-to-destination references. - Dry runs and gates
Evaluate directory assumptions and require workload prerequisites before the first controlled execution wave. - Workload jobs
Separate options, item state, concurrency controls, retries, resume behavior, and validation for each owning service. - Pipelines and waves
Link workload jobs to program stages, schedules, dependency order, and terminal-state monitoring. - Operational control
Live status, pause and resume behavior, failed-item review, health, metrics, and alert-ready telemetry. - Evidence and sign-off
Hash-chain audit verification, correlation IDs, exports, reconciliation, migration certificates, and recorded acceptance.
Execution services
Keep workload logic with the system that owns the data.
The control plane coordinates scope and sequence. Dedicated services implement each Microsoft workload's discovery, transfer, state, retry, and validation behavior.
| Service | Execution path | State and evidence | Boundary |
|---|---|---|---|
| Active Directory | Assigned customer-network agents execute approved directory commands after mapping and dry-run gates. | Object, stage, wave, agent, command, delta, rollback, and audit outcomes. | Execution, SID, ACL, password, and rollback paths require topology-specific controlled pilots. |
| Microsoft Entra ID | Microsoft Graph creates or updates supported users, groups, devices, and membership and runs selected expansion workflows. | Stable destination IDs, collision failures, source-to-target app IDs, and per-item outcomes. | Synchronization authority, consent, guest governance, app credentials, assignments, and device activation remain explicit. |
| Exchange Online | Graph mailbox clients copy supported content and settings between Microsoft 365 tenants and retain delta state. | Mailbox and folder counters, item fidelity outcomes, delta passes, reconciliation, DNS checks, and completion evidence. | On-premises onboarding, archives, public folders, and delegation use separate paths. |
| SharePoint and OneDrive | Graph drive, list, permission, provisioning, upload-session, and delta APIs operate on frozen assessed scope. | Site and account items, file and byte progress, conflicts, permissions, delta tokens, cutover pass, and validation. | Pages, apps, workflows, sharing links, and tenant governance are not implied by content transfer. |
| Microsoft Teams | Graph reconstructs workspace structure; optional migration mode imports channel messages when Microsoft approval is present. | Team, channel, membership, tab, tag, message, watermark, skipped-item, and validation outcomes. | Files, recordings, and meetings use other workloads; guests, apps, chats, and tenant policy need separate action. |
Deployment
Place each component where it belongs.
The control plane coordinates work and retains operational metadata. Agents perform approved directory operations from the customer network. Cloud engines access Microsoft services through customer-consented applications and approved outbound routes.
Control plane
SaaS or self-hosted
Portal, APIs, job orchestration, workers, configuration, operational metadata, reporting, audit, telemetry, and operator access.
Directory execution
Customer network agents
Outbound control-plane communication and customer-approved LDAP, LDAPS, and resource access for assigned operations.
Cloud execution
Microsoft Graph services
Customer-consented source and destination connections for enabled Entra ID and Microsoft 365 workload operations.
Control evidence
Answer what happened without reading raw logs.
Operators, migration leads, security teams, and business owners need different evidence from the same program record.
Acceptance state
- Scope version, options, mappings, and prerequisite gates
- Baseline, delta, cutover, reconciliation, and remediation
- Wave thresholds, stop conditions, and rollback ownership
Decision trail
- Role and operator actions with correlation IDs
- Hash-chain audit verification and export
- Completion evidence and formal sign-off record
Evaluate against your topology, not a generic demo tenant.
Bring your forests, trusts, object counts, target model, constraints, and success criteria to a technical session.