We have a parent company and a subsidiary operating from separate offices in Florida and Colorado. Each currently has its own on-premises Active Directory domain controllers. The parent company hosts most of the infrastructure and systems that the subsidiary will need to access. We're trying to determine whether the subsidiary's users and workstations can continue signing in with their existing domain while accessing resources in the parent company's domain, or whether we should migrate them into a single environment. What approach would be practical and secure?
4 Answers
The most direct option is to establish an AD trust between the two domains, assuming you have reliable connectivity such as a site-to-site VPN. The parent domain can then grant permissions to users or groups from the subsidiary domain. Plan the DNS, routing, authentication, security groups, and trust direction carefully before implementing it. A trust may be simpler and less disruptive than immediately migrating every account and workstation.
Given the amount of work involved, I’d also evaluate moving the subsidiary into the parent organization’s Microsoft 365 and Entra ID environment, possibly using a hybrid setup while on-premises systems are still required. A cloud-only or consolidated identity platform could reduce long-term complexity, but it should be based on application compatibility, licensing, connectivity, compliance, and migration requirements rather than treated as an automatic solution.
A trust is usually the lower-cost, lower-disruption starting point. You’ll need dependable connectivity between locations and will probably create resource groups in the parent domain that contain users or groups from the subsidiary domain. That lets the parent control access without forcing an immediate migration. It can also give you time to decide whether a future consolidation or cloud transition makes sense.
This is absolutely possible, but the right answer depends on details such as whether the forests are already connected, how DNS is designed, which systems require integrated authentication, the level of administrative separation needed, and whether the companies will remain separate legally and operationally. Because a mistake can affect authentication and access across both offices, it would be wise to have an experienced AD or Microsoft partner design and review the migration or trust plan before making changes.
The cloud route can be a good long-term direction, but the existing applications, file servers, legacy authentication, and workstation management should be assessed first. Those dependencies often determine whether a staged hybrid migration is needed.