Franklin halts Office 365 migration after authentication failures; director orders reboot and outside analysis

Jim Matelski, Franklin City director of information technology, told the Technology Commission on Feb. 24 that he had halted the city’s Office 365 migration and issued a termination for cause to the contracted firm, I Bailey, after authentication and synchronization work failed to reach usable reliability.

Matelski, who led the presentation, said the project was split into two phases: Phase 1 to build a Microsoft Office 365 government tenant (G3) and implement hardware two‑factor authentication (2FA) via YubiKey; Phase 2 to migrate mailboxes from the city’s on‑premises Exchange 2010 server to Office 365. He said the migration was fast‑tracked after a security incident and a cybersecurity insurer deadline but that Phase 1 never produced stable authentication for workstation (Windows) logins and Directory synchronization.

Matelski said, “I had to put this project on permanent ice and cancel our contract with I. Bailey. I did that.” He told the commission the contract was stopped on Jan. 31 and formal notice followed in early February, and that the city still pays monthly Office 365 license fees while the tenant remains active.

Why it matters: the city faced a 90‑day insurer requirement to implement 2FA and move off Exchange 2010; failure would jeopardize cyber insurance renewal. Matelski said the insurer extended the deadline to March but said the extension likely remains difficult to meet without a clear, tested path forward.

Key technical problems and vendor selection

Matelski said multiple vendors gave conflicting advice about whether direct migration from Exchange 2010 to Office 365 was possible and whether interim Exchange upgrades were required. He said I Bailey represented it could be done in one step and presented lower pricing, but Matelski now questions the firm’s depth and the adequacy of its pre‑migration analysis.

The presentation cited a set of technical constraints that were not fully discovered or resolved before onboarding: the city’s split internal/external namespace (internal: ci.franklin.wi.us; external: franklinwi.gov), required transforms for AD synchronization, Kerberos dependencies for Windows‑level authentication with YubiKeys, and differences between Microsoft commercial (E3) and government (G3) tenants.

Matelski described repeated failures when attempting to enable the Kerberos components that allow YubiKeys to authenticate at Windows login; he said AD synchronization “blew up” after Kerberos install attempts and Microsoft support engagement was slow and fragmented. He said, “When we did the installation of the Kerberos components for the YubiKey to work, it literally blew up synchronization server where we could not… we had to use the backup ad sync server.” Matelski said some PowerShell installation scripts worked only when pointed at a commercial (E3) tenant and consistently failed when run against a government (G3) tenant.

Funding and sunk costs

Matelski said the city included $129,692 in the 2024 capital budget for tenant creation, license procurement and implementation costs. He later told the commission the city is paying roughly $8,000 per month for licensing on a tenant that is not yet in production and described the licensing spend as a “sunken cost” of about $106,000 already committed since the tenant was built in November.

Next steps and recommended relaunch plan

Commission discussion focused on three recommended steps before any relaunch: (1) an independent pre‑migration feasibility and infrastructure analysis to document domain/UPN impacts, Kerberos/2FA compatibility with a G3 tenant, and minimum work needed to satisfy the insurer; (2) an identity‑first scoping call with a senior Microsoft engineer (Matelski asked staff to schedule a call with “Adrian” at Microsoft) and immediate FastTrack enrollment if the tenant qualifies for Microsoft FastTrack migration support; and (3) vendor re‑evaluation via RFQ/RFP or scoped engagement for a firm that can demonstrate recent, specific experience migrating government tenants from Exchange 2010 to Office 365 with YubiKey or equivalent hardware token 2FA.

Matelski said staff had contacted Convergent IT (formerly PDS), DigiCorp (which onboarded Mequon) and other regional firms to assess capacity and expertise. He recommended a phased “Phase 0” discovery engagement to find and document the “gotchas” before returning to implementation.

Decisions and actions recorded

Matelski reported that he had stopped all billable work from I Bailey on Jan. 31 and issued a termination for cause on Feb. 10, 2025. He also said the city retains ownership of the G3 tenant and the associated license subscriptions purchased through a reseller (Ingram Micro), and that the vendor’s access could be reduced while preserving tenant continuity.

Quotes and attribution

“I had to put this project on permanent ice and cancel our contract with I. Bailey. I did that,” Matelski said. He added courts‑of‑support commentary about Microsoft: “We could authenticate to Entra using my YubiKey… What wasn’t working was the Windows Hello logging into the workstation.”

What remains unresolved

Matelski and the commission flagged open questions the feasibility analysis must resolve: whether the city must perform a domain migration or can use AD sync transforms, whether Kerberos‑based desktop authentication will work on a G3 tenant, whether YubiKey installation scripts need revisions for government tenants, and what minimum work satisfies the insurer’s requirements.

The commission directed staff to arrange the Microsoft identity call, file for FastTrack engagement, and return with a defined statement of work for an independent feasibility analysis. Matelski said he will continue vendor outreach and staff training before relaunching implementation.

Ending

The Technology Commission met the city’s immediate operational constraint — unreliable 2FA and AD sync — by pausing the project, reclaiming control of the tenant and seeking a structured prelaunch analysis. Matelski said the goal is to show the insurer a credible, staged plan that achieves the insurer’s requirements as quickly as possible without repeating the earlier vendor missteps.