Considering a Microsoft 365 Migration? Here’s What to Expect

We move organizations to Microsoft 365 from just about any starting point: an aging Exchange server in a closet, Google Workspace, a hosted IMAP mailbox, or a mix of personal email, Dropbox folders and a shared drive on someone’s desktop. Whether you call it an Office 365 migration or a Microsoft 365 migration, each source moves differently and each has its own way of going wrong on the first Monday. Here is what the process involves, what to decide first, and the settings that belong in the plan from the start.

Why organizations are moving now

For many offices the trigger is an old server. Microsoft ended support for Exchange Server 2016 and 2019 on October 14, 2025. Those servers still run, but they no longer get security fixes, bug fixes or technical support. Microsoft’s options are Exchange Online in Microsoft 365, or Exchange Server Subscription Edition, which keeps you running and patching your own mail server.

• One platform: email, calendars, Teams meetings and chat, and files in SharePoint and OneDrive under one sign-in and one admin center.
• Security tools you can use. Business Premium adds Microsoft Defender for Business and Defender for Office 365 Plan 1 to the apps and email in Business Standard.
• Per-user licenses, so seats come and go with staff.
• AI built in. Microsoft launched Business Standard with Copilot and Business Premium with Copilot on July 1, 2026, with Copilot inside Word, Excel, PowerPoint and Outlook.

Microsoft renamed its small business Office 365 plans to Microsoft 365 in April 2020. Some enterprise plans still carry the Office 365 name. Our guide to what Microsoft 365 includes compares the plans, and Microsoft 365 vs Office 2024 covers the one-time purchase option.

Before the migration starts

Most migration problems trace back to planning. Before anything moves:

1. Inventory mailboxes, shared mailboxes, distribution lists, calendars, file shares, cloud storage accounts and anything that sends email, such as scanners, line-of-business software and your website.
2. Delete or archive data you don’t need. Less data means a faster move and less to protect afterward.
3. Pick a plan for each person. You can mix licenses, and Microsoft says organizations with more than 300 users should look at enterprise plans.
4. Check devices. Computers should run a supported version of Windows and Office. Office 2016 and 2019 also reached end of support in October 2025.
5. Take a full backup of the old system before you touch it.
6. Tell staff what changes, when, and what to do on the first morning. Surprises cause most of the help desk calls.

How an Office 365 migration works, by source

From an Exchange server

Microsoft supports cutover, staged and hybrid migrations. A cutover moves everything at once and is the usual choice for small offices. Microsoft says it can handle up to 2,000 mailboxes but recommends 150 or fewer because of how long larger batches take. Hybrid setups move mailboxes in smaller groups and suit larger or more complex environments.

From Google Workspace

The Exchange admin center has a Google Workspace migration that moves mail, calendars, contacts and rules in batches. Some things stay behind, including vacation and auto-reply settings, shared calendars, event colors and room bookings, so plan to set those up again.

From IMAP or personal email

IMAP migration works for many hosted email services, but Microsoft notes it moves only mailbox folders. Contacts, calendar items and tasks have to be moved separately.

Files

Microsoft’s Migration Manager, in the SharePoint admin center, moves content from file shares, Google Drive, Dropbox, Box and Egnyte into SharePoint, OneDrive and Teams. It can carry permissions over too, so review them first. A folder shared with “everyone” years ago keeps that access unless someone fixes it.

Security settings for day one

A new tenant is the easiest time to get security right, because nobody relies on the old way yet.

• MFA on every account, including admins and the accounts used during the migration. We use phishing-resistant sign-in such as passkeys or security keys for admin accounts, and app approval with number matching for everyone else.
• SPF, DKIM and DMARC for your domain. Microsoft recommends starting DMARC at p=none, watching the reports, then moving to quarantine and finally reject. Every client domain we manage is at p=reject. Our DMARC guide explains why it matters.
• Separate admin accounts that aren’t used for everyday email.
• Sign-in blocked on shared mailbox accounts, and on old accounts once their data has moved.
• External sharing in SharePoint and OneDrive set so files can’t be shared with anyone by default.
• A backup decision. Microsoft keeps the service running, but recovering from an accidental deletion, a departed employee’s mailbox or ransomware is on you. Our guide to secure data backup covers the options.

These sit inside the layered cybersecurity we put around every Microsoft 365 tenant. As a Microsoft CSP partner, we also handle the licensing for the move.

Email features worth setting up after the move

• Shared mailboxes for addresses like billing@ or info@. A shared mailbox can hold up to 50 GB without its own license.
• Shared calendars, so staff can see availability and book meetings without back and forth.
• Links instead of attachments, so everyone works on one copy and access can be revoked later.
• Microsoft Purview Message Encryption, for encrypted email to outside recipients on Gmail, Yahoo, Outlook.com and other services.
• Archiving for people who keep years of mail, so their main mailbox stays fast.

Compliance for regulated offices

Microsoft makes its HIPAA Business Associate Agreement available by default to customers who are covered entities or business associates, covering services including Exchange Online, SharePoint, OneDrive and Teams. Microsoft is also clear that using its services doesn’t make you HIPAA compliant on its own. You still need the right settings, policies and documentation, and the migration belongs in your risk analysis. See how we support healthcare practices.

Accounting firms, law firms and nonprofits with confidentiality obligations should settle retention, encryption and external sharing as part of the same project. It is far easier during the move than after.

Wherever your email and files live today, the first step is the inventory above. If you would like help with it, book a 20-minute call. Our Microsoft 365 services page covers the rest.

Sources: Microsoft Learn: Exchange Server 2019 and 2016 end of support roadmap; Microsoft Learn: Products reaching end of support on October 14, 2025; Microsoft Learn: Ways to migrate multiple email accounts to Microsoft 365; Microsoft Learn: Perform a Google Workspace migration to Microsoft 365; Microsoft Learn: Overview, migrate file shares with Migration Manager; Microsoft Learn: Migrate your content to Microsoft 365; Microsoft Learn: Microsoft 365 Business Premium FAQ; Microsoft Learn: Microsoft 365 and Office 365 plan options; Microsoft Learn: About shared mailboxes; Microsoft Learn: Microsoft Purview Message Encryption; Microsoft Learn: Set up DMARC to validate the From address domain; Microsoft Learn: HIPAA and HITECH Act compliance offering; Microsoft, Introducing Microsoft 365 Business with Copilot, May 2026; Microsoft, New Microsoft 365 offerings for small and medium-sized businesses, March 2020.