M&A Identity Merger Planner
Plan how an acquired company's identities join yours without importing its attackers: trusts versus migration, Entra/Azure AD tenant-to-tenant, privileged and service accounts, MFA parity, conditional access, SSO apps, leavers and break-glass.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- 25 planning items across strategy, privileged and service accounts, MFA and conditional access, SSO apps, joiner/mover/leaver hygiene, cross-tenant sync and break-glass.
- An identity-store table records every directory, tenant, cloud IAM and SaaS account store with users, privileged count, MFA coverage and the plan.
- Material gaps without a plan — unrotated admin credentials, over-privileged service accounts, unscoped sync — are flagged red.
- A readiness score shows how close the identity workstream is to connecting safely.
Frequently asked questions
Should we use a directory trust or migrate users after an acquisition?
A trust is quick but extends the blast radius of any compromise in the acquired domain into yours, so if you use one make it one-way and selective, gate it on a compromise assessment and set an end date. Federation or migration is usually safer long term. The planner records the decision and the reasons.
What are the biggest identity risks in an M&A integration?
Unknown privileged accounts, service accounts with domain-admin rights, weaker MFA in the acquired company, broad cross-tenant sync or trust settings, and leavers whose access is not removed in both organisations during the transition.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.