Skip to main content

Merge Organizations

Elijah
  • Updated

Team: Huntress Portal
Product: Huntress Managed Endpoint Detection and Response (EDR), Huntress Managed Identity Threat Detection and Response (ITDR), Huntress Managed Security Information and Event Management (SIEM) and Huntress Managed Security Awareness Training (SAT) 
Summary: This article covers how to combine two duplicate organizations in the Huntress Platform.  

In the Huntress Platform, you can merge duplicate organizations by moving EDR agents between them. This combines all the agents into the organization you want to keep, leaving the other organization empty and ready to delete. This article covers key considerations and step-by-step instructions to complete the process.

For situations that have products other than EDR and ITDR (such as SIEM and/or SAT), we recommend contacting Product Support for help combining the duplicate organizations. Please see the All Other Cases section of this article for more information.

 

Reasons for Duplicates

When you see duplicate organizations in the Huntress Platform (often with the same or very similar names), it generally means that agents are being deployed with different Organization Keys (org-keys) for the same customer. Because Huntress uses the org-key to decide where new agents belong, any mismatch in keys will create or repopulate a separate organization with agents.
 

Common causes:

  • Mismatched or changed org-keys - An organization is created or edited in the portal with one key, but scripts and Remote Monitoring and Management (RMM) policies are still using an older, or slightly different key. New installs go to a new organization while existing agents stay in the original one.
     
  • Multiple deployment tools or integrations targeting the same customer - Different RMMs or integrations may derive or use their own org-key or name format, so agents deployed from one tool land in one organization and agents from another tool land in a second org—even if the display names match. An example is NinjaOne RMM. NinjaOne will use the organization name (the Ninja org/site name) as the Huntress org-key and will also auto-create a new organization when that name doesn’t already exist.
     
  • Old or unknown automation still deploying with legacy keys - Legacy scripts, GPOs, or forgotten RMM jobs continue installing agents using an outdated org-key. This can recreate a previously deleted organization or keep feeding agents into an older duplicate while current deployment methods use a different key.

 

Steps to Merge

The following section will walk through the steps to combine duplicate organizations for EDR agents and/or ITDR. If any other products are involved that do not match the below cases, including SIEM or SAT, please see the All Other Cases section of this article.

 

EDR Agents Only

This section applies if the organizations you want to combine only contain EDR agents.

Which Organization to Keep 

Either organization can be kept. In many cases, it may be best to keep the organization with the most recent “Created” date, or where the most recent Agent installs are occurring. This can help you avoid updating organization keys and ensures new installs go to the correct organization. Please see the Reasons for Duplicates section of this article for more information. 

Merge Process

  1. Following the Agent Move article, move the Agents to the organization you want to keep.
  2. All the Agents will now be in one organization, and the other will be empty, shown below.
  3. Delete the empty organization using the 3 dots in the “Actions” column. Only delete the organization if it is empty. If there are still agents in the organization, deleting will automatically task them to uninstall.
  4. Merge completed. In this example, since the Agents were moved to the newest organization where the current installations were already going, no changes to the organization key was needed.

 

EDR Agents and ITDR Only

This section applies if one of the organizations contains Identities (ITDR).

Which Organization to Keep

We want to keep the organization with the Identities. ITDR is an integration that is tied to the organization and is not as easily moved or merged. The only way to move ITDR between organizations is to unmap and remap the tenant (see our remapping documentation for details). Doing so will result in data loss for that organization, so we recommend only moving EDR agents whenever possible. 

Merge Process

  1. Move the Agents to the organization with the Identities using the steps outlined in our Agent Move article.
  2. All the Agents and Identities will now be in one organization, and the other will be empty, shown below.
  3. Copy or note down the organization key in the “Key” column from the empty organization (see step 4). Proceed with deleting the empty organization using the 3 dots in the Actions column. Only delete the organization if it is empty.
  4. If you utilize deployment scripts, we recommend updating the org key of the remaining organization using the key copied in step 3, illustrated below. This will ensure future agents are installed to the correct organization.

If the organization with ITDR also has EDR agents, please pay special attention to which organization key is being used in your deployment scripts. If new installs are already going to the org with ITDR, then no organization key changes should be needed and you can disregard step 4 above.

 

All Other Cases

For all other combinations of products that were not listed in the steps above (Including SAT, SIEM, or any combination of them all), we recommend reaching out to Product Support for further assistance. Merging requires moving agents from one organization to another (combining the two), then deleting the empty organization (removing the duplicate). Since this process requires the deletion of an organization, there are some limitations and implications to consider for all other cases.

Note for SIEM 

If SIEM is involved, we generally recommend keeping the organization with SIEM. Deleting an organization does not remove historical SIEM data, but it can make searching for that data more difficult. In addition, HEC/API sources do not require the Huntress agent, so deleting an organization with these sources will remove the integration. Because of these implications, we recommend contacting Support for assistance.

Note for SAT

In some cases, remapping SAT can help combine duplicate organizations. At this time, SAT remapping can only be completed by Huntress internal teams. If you need your SAT account remapped to a different organization in Huntress, please submit a Support ticket.

 

 

Related articles