The scenario you'd like to do is not possible. You can only map users from one domain or workgroup to another as long as the target user isn't known in TFS. So your desire, to be able to run new users and old users side-by-side, is technically not possible.
It is not possible to merge two existing users that are known by TFS.
Your only option is to do this as part of the migration/upgrade procedure and is only possible as long as the new identities are not known by TFS in your case that means that the target users cannot be part of Active directory before the migration and must be part of active directory after the migration of TFS.
After you've completely shut down TFS (usually after uninstalling the Application Tier for the older version), you can use the following command to map an existing identity to a new and to the server unknown identity that should exist after migration:
TfsConfig identities /change /fromdomain:<D1> /todomain:<D2>
[/account:<N1> [/toaccount:<N2>]]
[/sqlInstance:<sqlInstance>
/databaseName:<databaseName>]
You may need to run this command for each individual account. The fromdomain
can be name of the server that is hosting the current local users.
Once all the mapping is done, create the exact same users in active directory and restart/install+start the (new) Application Tier. During the servicing steps these users should now be synced to Active directory and all of their "possessions" in TFS should be migrated over to the new user.
Note: Make sure you have a backup database available that doesn't yet know the target users so you can perform this step a couple of times, should you not succeed the first time.
Note: this procedure will likely cause some downtime during the upgrade and requires synchronized activities between the TFS admin and the domain folks. Unfortunately, that's the way it is.