Cross-Tenant Identity Mapping (CTIM): The Mapping Step that Makes Orchestrator Work

Cross-Tenant Identity Mapping (CTIM) is Microsoft's tool for mapping source users to target users one-to-one so content, permissions, and user experiences remain consistent. Running identity mapping is required when you migrate user data using the orchestrated method.

What CTIM does (in practical terms)

CTIM helps you:

·       Map users one-to-one between tenants and reduce manual errors.

·       Update properties so users have correct attributes for migration.

·       Maintain mapping data so the correct source content lands on the correct target user.

When to run CTIM

Microsoft recommends running CTIM after creating target users and before migrating data. This sequence improves accuracy and avoids manual cleanup work.

Security and compliance note (data-at-rest and network)

CTIM stores different categories of data in different regions (for example, reports in the tenants' Exchange Online regions, and temporary mapping file copy stored in the European Union for up to 48 hours). CTIM communicates over encrypted traffic and relies on published Microsoft 365 URL and IP ranges.

Operational governance: treat CTIM as production state

Once migrations are underway, avoid removing CTIM data unless you have a clear change plan. Microsoft notes that identity mapping data is stored until you explicitly delete it. Build a cleanup checkpoint into your cutover plan so you remove CTIM data only after you confirm migrations and user acceptance are complete.

Source links (Microsoft Learn)

·       https://learn.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-identity-mapping?view=o365-worldwide

·       https://learn.microsoft.com/en-us/microsoft-365/enterprise/migration-orchestrator-6-post-migration?view=o365-worldwide