Tenant-to-tenant migrations are one of the most complex operations in the Microsoft 365 ecosystem. A missing step before cutover can mean lost emails, broken permissions, or users locked out of Teams channels. This checklist covers every stage.
Before you start
- Confirm source and destination tenant admin credentials — you need Global Admin on both sides to grant app registration consent.
- Run a licence audit on the destination tenant. Every migrated mailbox needs an Exchange Online licence. SharePoint and OneDrive require a plan that includes those workloads.
- Map UPNs. If your source domain is contoso.com and the destination is fabrikam.com, you need a clear source→destination email mapping before you start.
- Check for shared mailboxes, resource mailboxes (rooms, equipment), and distribution lists — these are often forgotten and need to be in scope.
- Verify MX records and mail flow. During migration, the source MX should remain active. Plan the cutover window for when you'll flip DNS.
- Identify large mailboxes (>50 GB) — these take longer and may need to be scheduled first or run overnight.
- Disable any third-party email security gateways (Mimecast, Proofpoint) or add the migration service IP to the allow list so messages aren't blocked.
During the migration
- Monitor per-mailbox progress in real time. A stalled mailbox (no items moving for >30 minutes) usually means a permissions issue or an oversized item.
- Check error logs for throttling (HTTP 429). Graph API throttles at scale — a good migration tool handles retry with backoff automatically.
- Don't migrate Teams channels until mailboxes are done — Teams relies on Exchange for calendar and contact data.
- Run a delta sync pass 24–48 hours before cutover to catch mail received after the initial copy.
⚠
Never migrate OneDrive and SharePoint at the same time as email on the same worker nodes. They compete for the same Graph API throttle budget and both slow down.
Cutover day
- 1Freeze the source tenant — disable new email creation, set out-of-office on key mailboxes, lock SharePoint for editing.
- 2Run a final delta sync to catch any last-minute changes.
- 3Update MX records to point to the destination tenant. TTL should have been lowered to 300s at least 48 hours prior.
- 4Update Autodiscover records so Outlook clients reconnect to the new tenant.
- 5Confirm Outlook profiles connect to the new mailboxes for a sample of users before announcing cutover complete.
- 6Update any line-of-business applications that send email via SMTP to use the new tenant's SMTP relay.
Post-migration verification
- Send a test email to each migrated domain and confirm delivery.
- Spot-check 5–10 mailboxes for correct item counts, calendar events, and contacts.
- Verify Teams channels are visible and message history is accessible.
- Check SharePoint sites load and permissions are intact for both owners and members.
- Confirm OneDrive files are accessible and sync clients reconnect.
- Decommission the source tenant after a 30-day confirmation window — don't rush this.
✦
Keep the source tenant active in read-only mode for at least 30 days. Users will remember items they forgot to check only after the cutover.