Technology Commission backs full domain migration to fix Microsoft 365 rollout

The Franklin City Technology Commission voted March 26 to pursue a full Active Directory domain migration to address failures in the city's Microsoft 365 rollout and to enable two‑factor authentication.

Commissioners and city IT staff discussed a feasibility study that found the city's internal domain (ci.franklin.wi.us) is unroutable and not supported for production use by Microsoft cloud services. That mismatch caused Microsoft Intune device enrollment and Entra ID (formerly Azure AD) local authentication to fail, preventing the planned YubiKey-based two‑factor authentication rollout.

The study presented three technical options: use Active Directory Federation Services (AD FS), add a secondary user principal name (UPN) suffix and switch accounts to it, or perform a full domain migration to a new routable domain and recreate accounts. Staff recommended the full migration as the most robust long‑term fix, while noting the secondary‑UPN change would be a quicker short‑term workaround.

According to the study, Intune requires properly routable identities to enroll devices and enable Windows Hello for Business. Staff said the Microsoft guidance and a Microsoft security architect confirmed that Intune and related services will not reliably operate with a non‑routable internal domain in production. The city’s consultant work identified missing Intune/MDM registration on affected machines and license‑binding issues that caused enrollment requests to fail when accounts were presented with the ci.franklin.wi.us suffix.

The commission discussed security and cleanup work the migration would require, including standardizing user account naming, reducing legacy shared accounts used by police, fire and treasury staff, and hardening Kerberos/LDAP settings. Staff said the migration would also allow the city to move to newer Windows Server encryption defaults, reduce legacy SMB usage, and make the environment easier to audit for CJIS and other compliance regimes.

Staff proposed issuing an RFP for consultants to do the migration. The proposal presented a consulting estimate of $30,000 for work on the domain conversion and additional costs for licensing and tenant reconfiguration. Staff outlined a schedule: get RFPs to consultants by mid‑April, review proposals in late April, request Common Council approval of the contract on May 6, and target completion of migration work and cloud cutover by August.

Commissioners raised operational impacts: shared accounts and batch workflows used at the Treasury counter, multi‑shift police operations, and transient staffing in high‑volume months (for example, December property tax processing). Staff emphasized these are process and training issues that must be addressed prior to migration; training, internal champions and phased rollouts by department were proposed to reduce disruption.

On a motion for the full domain migration path, the commission voted by voice vote to proceed. Staff will issue an RFP for consulting services, review proposals in late April, and seek Common Council approval for the chosen vendor in May.

Votes at a glance: - Approval of February 26, 2025 meeting minutes — motion passed (voice vote; transcript records approval but individual votes not named). - Motion to pursue full Active Directory domain migration (issue RFP and procure consulting support) — approved (voice vote; transcript records approval; individual tallies not recorded). - Motion to recommend the NIST-based media‑protection policy to Common Council — approved (voice vote; see separate article). - Motion to recommend the NIST-based physical and environmental security policy to Common Council — approved (voice vote; see separate article).

What happens next: Staff will finalize and issue an RFP for domain‑migration consulting and tenant reconfiguration, collect proposals, and present recommendations to the Technology Commission in late April. The commission will forward a contract recommendation to the Common Council for final approval on May 6. The migration and associated tenant work (Entra ID/Intune configuration, Exchange Online migration) were targeted for completion by August, per the staff timeline.