Moving to Microsoft 365 (M365) isn’t just “mailboxes to the cloud.” You’re shifting identity, email, files, chat, meetings, security, and device management. Treat it like a business change, not only a technical project.
What “good” migration looks like
- Zero or minimal email downtime
- Clean identity model (single sign-on, MFA)
- Files end up where people can actually find and share them (OneDrive/SharePoint)
- Teams launched with clear governance
- Security baseline on Day 1 (MFA, device encryption, safe links/attachments)
- Simple, friendly training so the rollout sticks
Phase 0 — Decide scope and success criteria
Define what’s in scope now vs. later
- Email & calendars (Exchange Online)
- Personal files (OneDrive for Business)
- Shared drives (SharePoint)
- Chat/meetings (Teams)
- Device management (Intune) — optional for phase 1
- Security & compliance baseline (MFA, Conditional Access, backups, retention)
Success looks like
- Everyone logs in with one account + MFA
- Inbox/calendar working on all devices
- Old shares accessible in SharePoint with the same or better permissions
- Teams channels exist for real departments/projects (not chaos)
- Helpdesk ticket volume returns to normal within 2 weeks
Phase 1 — Readiness & discovery (1–2 weeks
1) Inventory what you have
- Email: provider (on-prem Exchange, Google Workspace, IMAP), # mailboxes, sizes, aliases, shared mailboxes, distribution lists, forwarding rules.
- Files: file servers/NAS shares (size, path, typical permissions), Google Drive/Dropbox/Box, user home drives.
- Apps: anything sending mail (scanners, line-of-business apps), room/resource calendars.
- Identity: Active Directory? Azure/Entra ID? Google? Local accounts only?
- Devices: Windows/macOS mix, mobile (iOS/Android), who uses what.
2) Choose identity model
- Cloud-only (Entra ID only): simplest for small orgs, no on-prem AD.
- Hybrid (Entra ID Connect): if you have AD and want to keep it, sync users/password hashes.
- Password writeback if you want users to reset passwords in the cloud.
Tip: If you’ll retire on-prem servers in the next 12 months, don’t over-invest in hybrid. Keep it as a bridge.
3) Pick migration approach for mail
- Cutover (all at once): ≤150 users, simple and fast; a single weekend.
- Staged: migrate batches over days/weeks; users coexist in both systems temporarily.
- Hybrid Exchange: for large orgs/sticky Outlook features, or complex compliance needs.
4) Licensing & tenant set-up
- Create your Microsoft 365 tenant, choose primary region.
- Pick licenses (e.g., Business Standard/Premium, or Microsoft 365 E3/E5).
- Business Premium is a great default for SMEs (adds Intune + Defender).
- Assign pilot licenses to 5–10% of users (a good cross-section).
5) Baseline security (do this before go-live)
- Turn on MFA for all users (start with admins).
- Block legacy/basic auth for protocols you don’t need.
- Enable Defender for Office 365 features: Safe Links, Safe Attachments.
- Set initial Conditional Access (e.g., block access from risky locations, require compliant device for admins).
Phase 2 — Domain & email prep (3–7 days)
1) Verify domains
- Add your company domain(s) in M365 admin; create the TXT record to verify ownership.
2) Plan DNS cutover
- Lower TTL on MX and Autodiscover records (e.g., to 5–15 minutes) a few days before the migration weekend.
3) Mail hygiene (deliverability)
- Publish SPF to include Microsoft (
include:spf.protection.outlook.com). - Enable DKIM for your domain in Exchange Online.
- Publish DMARC with
p=nonefirst; tighten later.
4) Build user objects
- Cloud-only: import users via CSV or create manually; assign licenses.
- Hybrid: install Entra ID Connect, choose OU filters, run initial sync; assign licenses in M365.
5) Pilot mail migration
- Use the Microsoft 365 Exchange migration wizard to move 5–10 pilot users (from Google, Exchange, or IMAP).
- Validate: messages, folders, calendar items, send/receive both directions.
Phase 3 — Files & collaboration plan (in parallel)
1) Design where data will live
- Personal files → OneDrive (each user).
- Department/project data → SharePoint sites + Teams channels.
- Keep structure simple: HR, Finance, Sales, Projects. Avoid deep nesting.
2) Migrate files
- From file servers → SharePoint Migration Tool (SPMT) or Mover (legacy tool; many use third-party like BitTitan/SkyKick for complex perms).
- From Google/Dropbox/Box → use native connectors or third-party tools.
- Map permissions: NTFS → SharePoint (Owners/Members/Visitors). Clean up broken inheritance.
3) Teams readiness
- Create a few well-named Teams (Departments, Leadership, Projects).
- Set naming policy and guest access rules.
- Pilot chat/meetings; test meeting policies, lobby, recordings storage (OneDrive/SharePoint).
Phase 4 — Pilot (1–2 weeks)
Who: mix of roles (ops, finance, sales), tech-comfortable and less-technical users.
What to test:
- Sign-in + MFA on all devices
- Outlook desktop/web/mobile; calendars, shared mailboxes, rooms
- OneDrive sync client (Known Folder Move for Desktop/Documents/Pictures)
- SharePoint permissions and links
- Teams chat/meetings/guest invites
- Printers/scanners/applications that send email (SMTP relay via Exchange Online)
Fix: anything rough before the big roll-out. Capture FAQs for training.
Phase 5 — Cutover weekend (for cutover/staged scenarios)
Checklist (email)
- Final mailbox sync run; check for failures.
- Change MX and Autodiscover to Microsoft 365.
- Disable old mailbox access (or set forwarding, for staged moves).
- Reconfigure SMTP relay devices/apps to use Exchange Online (authenticated or connector).
- Validate: send/receive internally and externally; calendar free/busy.
Checklist (files)
- Final delta copy for file shares.
- Lock old shares to read-only.
- Spot-check permissions in SharePoint.
- Switch any mapped drives to SharePoint shortcuts (OneDrive “Add shortcut to OneDrive”).
Comms to staff (Friday 16:00)
- What’s happening, when, and what they’ll see Monday.
- How to sign in (SSO/MFA), where email/files live, where to get help.
- Link to 2–3 short “how to” clips (Outlook, OneDrive, Teams basics).
Phase 6 — Day 1 to Day 10 (stabilisation)
Support plan
- Floor-walking or extended helpdesk hours for the first week.
- Common fixes:
- Re-add Outlook profile if autodiscover is cached
- OneDrive sync sign-in & Known Folder Move prompts
- Teams notifications and meeting joins
- Daily stand-up to review top issues and quick wins.
Security tightening (after baseline holds)
- Conditional Access: require compliant device for admins and high-risk apps.
- Start blocking any legacy protocols still in use (POP/IMAP/EWS if unneeded).
- Turn on mailbox auditing and review alerting.
Identity & device management (when ready)
Intune (highly recommended, even if phase 2)
- Windows: Autopilot, device compliance (encryption, AV, patch), app deployment (Office, browser, VPN).
- macOS: enforce FileVault, install Office/Company Portal, set profiles.
- Mobiles: app protection policies (wipe company data if device lost).
Conditional Access examples
- All users: MFA.
- Admins: compliant device + MFA, block legacy auth.
- High-risk sign-ins: require password reset.
- Block access from countries you don’t operate in.
Compliance, retention, and backups
Retention
- Use Microsoft Purview retention policies for mail/Teams/SharePoint.
- Keep it simple: e.g., 7 years for email/finance; 3 years for general docs.
eDiscovery
- Enable Core eDiscovery or eDiscovery (Standard) for legal holds and searches.
Backups (important!)
- Microsoft provides availability, not point-in-time backup. Use a SaaS backup for Exchange, SharePoint, OneDrive, Teams with immutable storage and easy restores.
- Test a restore quarterly.
Apps and SMTP relay
- Multifunction printers/scanners: use Exchange Online authenticated SMTP or create a connector for your static IP.
- Line-of-business apps: update SMTP settings; if they can’t do modern auth, use a dedicated mailbox + app password alternative (or secure connector). Avoid open relay.
Governance (keep Teams/SharePoint tidy)
- Team creation: allow only certain groups, or require a naming policy (e.g., “DEPT-Finance”, “PRJ-AcmeRolloff”).
- Guest access: allowed only for specific teams, external domains allow-list, links expire.
- Lifecycle: archive/delete inactive Teams and sites every 6–12 months.
Risks & how to avoid them
- Throttling during large moves: schedule overnight jobs, run parallel batches sensibly.
- Stuck autodiscover: Outlook profile cache—create a new profile if needed.
- Broken file permissions: plan mapping NTFS → SharePoint roles; avoid dumping everything into one site.
- User confusion: over-communicate; give short videos and quick reference cards.
- Security gaps: don’t postpone MFA and Safe Links/Attachments “until later.”
Cost planning (common line items)
- Microsoft 365 licenses (Business Basic/Standard/Premium or E3/E5)
- Migration tooling (if using BitTitan/SkyKick) vs. native tools (free)
- SaaS backup subscription
- One-off professional services / internal project time
- Training content and floor-walking support
Training pack (what people actually need)
- 5-minute videos: Outlook basics, Teams meetings, OneDrive sync & sharing, “Find your old files”.
- One-pager: Sign-in + MFA steps with screenshots.
- 30-minute live session day 1 and day 3; record and share.
Sample communications
Pre-migration (T-5 days)
We’re moving email and files to Microsoft 365 this weekend. Expect a faster, more secure setup and easier sharing. On Monday, you’ll sign in with your company account and confirm MFA. Your email will look the same in Outlook; your files will be in OneDrive/SharePoint. We’ll be on hand to help—reply to this email with any concerns.
Go-live morning
Welcome to Microsoft 365. If Outlook asks to restart, do it. If OneDrive prompts to back up Desktop/Documents, click OK. For help, call x123 or open a Teams chat with IT.
Final checklists
Technical cutover (mail)
- Domains verified; TTL lowered
- Users/licences created
- SPF/DKIM live; DMARC
p=none - Pilot migrated/validated
- MX/Autodiscover switched
- SMTP devices/apps reconfigured
- Mail flow tested (in/out, calendar, shared mailboxes)
Files & Teams
- SharePoint sites created and owners assigned
- OneDrive sync deployed; Known Folder Move enabled
- Shares migrated; final delta completed
- Old shares read-only; shortcuts added
- Teams naming/guest policies set
Security & compliance
- MFA on for all users; legacy auth blocked
- Safe Links/Attachments on
- Conditional Access baseline live
- Mailbox auditing on; alert policies set
- SaaS backup configured & test restore done
- Retention policy applied (where needed)
Adoption & support
- Training videos and quick guides sent
- Floor-walking/helpdesk extended hours week 1
- Daily review of top issues + fixes
- Post-migration survey and lessons learned
FAQs
How long does a typical SME migration take?
Small teams can complete in 2–4 weeks (including pilot). Larger/complex environments may take 6–12 weeks.
Will users lose email or files?
They shouldn’t. Use delta syncs, final cutover, and keep the old system read-only for a short time as a safety net.
Can we keep using Outlook on our PCs/Macs?
Yes. Outlook connects to Exchange Online; many users won’t notice the backend change.
Do we need backups if data is in Microsoft 365?
Yes. Microsoft provides service availability, not point-in-time recovery for all scenarios. Use a third-party backup.
What about compliance (UK GDPR)?
Use retention policies, DLP, and good sharing hygiene. Keep audit logs and consider eDiscovery if you have legal hold needs.
30/60/90 plan (summary)
- 0–30 days: Tenant, licenses, MFA, domain verify, pilot mail + files, security baseline, training content.
- 31–60 days: Full mail cutover, file migrations, Teams rollout, helpdesk support, backup in place.
- 61–90 days: Intune/device baselines, tighten Conditional Access/DMARC, governance & lifecycle, monthly security/adoption dashboard.
Planning a move to Microsoft 365? Our IT support team manages migrations end to end, with no data loss and minimal downtime.