as per i know below process we did :
1. Move all AP to One Controller, so other controllers are ready for preparation of your HA / SSO.
2. Once all the AP are working as expected, after monitoring 1 or 2 days or depends on business requirement.
3. Turn off the controller which has no AP.
4. Build fresh config with HA and SSO
https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-7/High_Availability_DG.html
5. Then move 1 or 2 Test AP, non critical AP to new controller and test it.
6. Once all working as expected, Move department wise or floor wise or building wise to new controller.
7. Once all AP moved, prepare for standby and join them to HA.
Note : Look for License installations.