Post-Merger IT Integration: The 90-Day Playbook

Mergers and acquisitions generate enormous strategic value — on paper. In practice, 50–70 % of M&A deals fail to deliver their expected synergies, and IT integration is the single largest execution risk. The technology estate touches every employee, every customer interaction, and every financial control. Get it wrong and you bleed talent, revenue, and credibility.

At CC Conceptualise we have guided multiple post-merger IT integrations across Europe. This playbook distils those lessons into a structured 90-day framework that enterprise IT leaders can adapt immediately.

Why 90 Days?

The first 90 days set the tone for the entire integration. Delays compound: an unresolved identity conflict in week two becomes a security incident in month three. The 90-day window forces prioritisation and creates visible momentum for the board.

Key principle: You are not rebuilding IT from scratch. You are creating a single, governed environment that both organisations can trust — fast.

Phase 1: Day-1 Readiness (Weeks 1–2)

Day-1 is the legal close date. On that day, the acquiring company assumes responsibility for the target's data, security posture, and regulatory obligations. Everything in this phase must be complete before the deal closes.

Connectivity and Communication

Establish a secure communication channel (e.g., a shared Teams tenant or bridged Slack workspace) so integration teams can collaborate from Day 1
Set up a temporary VPN or SD-WAN link between the two corporate networks with strict firewall rules — no flat routing
Ensure email flow between both domains works without SPF/DKIM failures; add the target's domains to your Safe Senders and transport rules

Security Baseline

Run a rapid security assessment of the target's environment: endpoint protection coverage, MFA adoption, privileged account inventory, and patch currency
Deploy your EDR agent to critical servers in the target environment within the first 48 hours
Ensure both organisations' SOCs have mutual visibility — at minimum, forward the target's security logs to your SIEM

Governance and Compliance

Identify regulatory constraints that affect data residency or system access (GDPR, industry-specific rules)
Establish an integration steering committee with weekly cadence: CIO/CTO-level sponsorship, workstream leads, PMO

Phase 2: Identity Consolidation (Weeks 3–5)

Identity is the backbone of integration. Until you have a single, trusted identity plane, every downstream workstream — application access, email migration, collaboration — is blocked.

Assess the Identity Landscape

Inventory both Active Directory forests and Entra ID (Azure AD) tenants: number of users, groups, service accounts, conditional access policies, and third-party SAML/OIDC integrations
Map UPN formats and email address policies — conflicts here cause the most visible user disruption
Document MFA methods in use (Authenticator, FIDO2, SMS) and plan re-enrollment or migration

Choose an Integration Pattern

Pattern	When to Use	Complexity
Cross-tenant sync + B2B	Coexistence period needed; both tenants stay alive	Medium
Tenant-to-tenant migration	Full consolidation into one tenant	High
Forest trust + selective sync	On-premises AD remains authoritative	Medium–High

For most mid-market deals, we recommend starting with cross-tenant synchronisation to enable collaboration immediately, then planning a full tenant migration within 6–12 months.

Execute Identity Bridging

Configure Entra ID cross-tenant sync or deploy a tool like Quest / Binary Tree for identity mapping
Create a unified group naming convention and begin provisioning access packages
Harmonise conditional access policies: pick the stricter baseline and apply it to both populations

Watch out: Service accounts and non-human identities are the silent killer. A single hard-coded credential in a legacy LOB app can block an entire application migration. Inventory them early.

Phase 3: Network Integration (Weeks 4–7)

Design the Target Network Architecture

Define the long-term network topology: hub-and-spoke, Virtual WAN, or mesh. Do not build a permanent bridge on the temporary VPN
Plan IP address space carefully — overlapping RFC 1918 ranges are almost guaranteed. NAT is a stopgap, not a solution
Consolidate DNS: create a unified internal DNS namespace and configure conditional forwarding during coexistence

Execute in Stages

Stage 1: Site-to-site connectivity via Azure Virtual WAN or ExpressRoute with strict NSG rules
Stage 2: Migrate the target's on-premises workloads into your landing zone subscriptions (or create dedicated ones under your management group hierarchy)
Stage 3: Decommission the temporary VPN and legacy circuits

Zero Trust Considerations

Do not assume the target's network is trusted. Apply micro-segmentation from day one
Require device compliance checks via Intune before granting access to corporate resources
Use Private Endpoints for all PaaS services — no public internet exposure during integration

Phase 4: Application Rationalisation (Weeks 5–10)

This is where the synergy numbers live — and where most integrations stall.

Build a Unified Application Portfolio

Merge both organisations' application inventories into a single CMDB. For each app, capture: business owner, user count, technology stack, hosting model, annual cost, and criticality tier
Categorise every application into one of five dispositions: Retain, Replace, Retire, Re-platform, or Rationalise (merge with an equivalent)

Prioritise Ruthlessly

Quick wins: Retire duplicate SaaS subscriptions (two Jira instances, two ServiceNow tenants). This often saves six figures within weeks
High impact: Consolidate ERP and CRM systems — but plan these as 6–18-month programmes, not 90-day sprints
Low hanging fruit: Standardise on a single collaboration platform (Microsoft 365 or Google Workspace) and migrate the smaller population

Manage Technical Debt

Every acquisition brings hidden technical debt. Budget 15–20 % contingency on application migration timelines
Prioritise applications that are on end-of-life platforms or have known security vulnerabilities

Phase 5: Communication Strategy (Continuous)

The most technically perfect integration will fail if employees do not understand what is happening, when, and why.

Principles for Effective Communication

Over-communicate the timeline. Publish a single-page integration calendar visible to all employees. Update it weekly
Name the pain. Acknowledge that there will be disruption. Employees respect honesty far more than corporate optimism
Provide a single support channel. Stand up a dedicated integration help desk (or a dedicated queue in your ITSM tool) so users do not bounce between two support teams
Celebrate milestones. When the email migration completes or the VPN goes live, announce it. Visible progress builds trust

Stakeholder Management

Brief the board monthly with a traffic-light dashboard: timeline, budget, risk, and synergy realisation
Hold weekly 30-minute standups with workstream leads — no slide decks, just blockers and decisions
Identify integration champions in each department who can answer peer questions and escalate issues

The 90-Day Milestone Checklist

Week	Milestone
1–2	Day-1 readiness: connectivity, security baseline, steering committee
3–5	Identity bridge live; cross-tenant collaboration enabled
4–7	Network integration Stage 1 complete; DNS unified
5–10	Application portfolio categorised; first retirements executed
8–12	Email migration complete (or coexistence stable); cost synergies quantified

Common Anti-Patterns

Boiling the ocean: Trying to consolidate everything at once instead of phasing. Start with identity, then email, then apps
Ignoring the target's IT team: They know where the bodies are buried. Retain key staff through the integration window with stay bonuses
Under-investing in tooling: Cross-tenant migration tools, CMDB platforms, and network monitoring are not optional — they pay for themselves in avoided outages
Treating security as a Phase-2 problem: Security is Phase 0. The moment legal close happens, the acquiring company owns every vulnerability in the target's estate

How CC Conceptualise Helps

We provide hands-on integration leadership — from pre-close due diligence through to post-migration hypercare. Our consultants have delivered M&A IT integrations across financial services, manufacturing, and technology sectors in DACH and beyond.

If you are facing an upcoming merger or acquisition and need a structured integration plan, get in touch. The first 90 days are the ones that matter most.