Microsoft 365 migration checklist for small businesses

A Microsoft 365 migration is more than moving old email into new mailboxes. It changes how people sign in, share information, collaborate, recover accounts and access business data. A rushed move can create missed messages, duplicate files, incorrect permissions and frustrated users.

A controlled migration begins with a clear inventory, agreed ownership and measurable acceptance criteria. The objective is not simply to copy data—it is to establish a secure, supportable Microsoft 365 environment that employees can use confidently.

Define exactly what will move

Identify the current email provider, file locations, collaboration tools, devices, applications and authentication methods. Decide whether the project includes Exchange Online, OneDrive, SharePoint, Teams, desktop applications, mobile devices, shared mailboxes, archives and third-party integrations.

Document what will not move, how long the source system will remain available and who can approve exceptions. Choose a migration approach based on the source platform, number of users, data volume, business schedule and tolerance for interruption.

Twelve items to complete before migration

1. Confirm tenant ownership

   Record the Microsoft 365 tenant, subscription owner, billing contact and at least two protected administrator accounts controlled by the business.

2. Inventory every user and mailbox

   List employees, contractors, shared mailboxes, aliases, distribution lists, rooms and service accounts. Mark inactive or duplicate accounts for an approved disposition.

3. Choose suitable licenses

   Match licensing to required applications, mailbox capacity, device management and security capabilities. Avoid assigning the same package automatically when roles have different needs.

4. Record the source environment

   Document mailbox sizes, file volumes, permissions, calendars, contacts, forwarding, mobile devices and integrations. Capture known errors before they are blamed on the migration.

5. Review the business domain

   Confirm access to the domain registrar and DNS host. Export current DNS records and identify the person authorized to change MX, TXT, CNAME and other records.

6. Create users before mail cutover

   Provision required users, mailboxes and aliases before directing new mail to Microsoft 365. Verify names, addresses and licenses against the approved inventory.

7. Plan identity and MFA

   Decide how users will authenticate, require multifactor authentication and establish secure account recovery. Separate everyday and administrator identities.

8. Clean and classify information

   Remove approved obsolete material, identify sensitive records and resolve ownership. Do not migrate unmanaged clutter when retention or deletion decisions are required.

9. Map files and permissions

   Choose appropriate destinations for personal files, team documents and shared business records. Rebuild permissions around roles and ownership instead of copying excessive access.

10. Assess applications and devices

    Identify software that sends email, uses calendars, stores credentials or depends on file paths. Confirm supported clients, operating systems and available device storage.

11. Protect the source and destination

    Maintain recoverable copies of important information, preserve required records and avoid deleting the source until validation and retention decisions are complete.

12. Prepare communications and support

    Tell users what will change, when work begins, what they must do and how to get help. Prepare short sign-in, MFA, Outlook, mobile and file-access instructions.

Prepare a secure destination

Add and verify the custom domain, create the approved users and configure required DNS records. Establish administrator protections, MFA, recovery contacts, sharing rules and baseline security before general use. Review mail-flow requirements and configure SPF, DKIM and DMARC through an appropriate staged plan.

Design the file destination before copying content. OneDrive is generally suited to an individual’s working files, while SharePoint and Teams support shared organizational content. Name sites and teams consistently, assign business owners and test external-sharing behavior.

Pilot first, then control the cutover

A pilot should include different roles, mailbox sizes, devices and working patterns. Do not treat a successful administrator test as proof that every employee workflow is ready. Define a pause or rollback decision before the cutover begins.

Post-migration validation checklist

1. Mail and calendars

   Test internal and external messages, replies, aliases, shared mailboxes, calendar history, delegation and mobile access.

2. Files and collaboration

   Compare expected data, folder ownership, permissions, sharing links, Teams access and important version history.

3. Security

   Confirm MFA enrollment, administrator separation, alerts, external sharing, audit visibility and removal of temporary migration access.

4. Applications

   Test scanners, websites, accounting tools and other systems that send mail or depend on Microsoft identities and files.

5. User acceptance

   Obtain confirmation from department owners and document missing items, workarounds and assigned corrective actions.

6. Closure

   Retain the source for the approved period, complete final backups and records, recover licenses and decommission only after written approval.

Official guidance and next steps

Microsoft documents multiple migration paths depending on the source environment. It also notes that an IMAP migration moves email folders but not contacts, calendars or tasks, and that target mailboxes must exist before an IMAP migration. These limitations should be included in the plan and user expectations.

Review Microsoft’s guidance for adding a custom domain, selecting an email migration method and multifactor authentication. Related CommzzTech guidance includes the Microsoft 365 security checklist, employee access checklist and backup and recovery guide.

Important: This article provides general information. Migration requirements vary by source platform, licensing, data types, retention obligations and technical configuration. Test the selected method and obtain appropriate technical, legal, privacy and records guidance.

← Back to all resources