Exchange Online Migration: Steps, Pitfalls, and Timeline
Exchange Online migration is a one-time task that must succeed on the first try. Read about the methods, pitfalls, and timeline for a secure email move to the cloud.
Exchange Online migration is a decision you implement only once in practice – so it must succeed the first time. A poorly chosen method or inconsistent DNS means hours of email downtime and lost messages. This guide explains the three main migration methods, when each pays off, and what a realistic timeline looks like for a Slovenian MSP.
3 migration methods: which one to choose
| Method | For whom | Duration | Coexistence |
|---|---|---|---|
| Cutover | Up to ~50 mailboxes | Up to 1 week | No |
| Staged | 50–2000 mailboxes | A few weeks | Partial |
| Hybrid | Demanding environments, multiple servers | 1–3 months | Full |
Cutover migration
Everything at once. Suitable for small businesses where one "big night" over the weekend is feasible. Simple, but without the option for a gradual transition.
Staged migration
Mailboxes are moved in batches. Users in different phases have their mail in different locations. Suitable for medium-sized companies.
Hybrid migration
We set up an Exchange Hybrid Server that acts as a bridge between local Exchange and Exchange Online. Users on both sides see a shared schedule and a common global address list. The most expensive option, but the smoothest.
Prerequisites often overlooked
- Clean Active Directory / Entra ID: account synchronization without duplication.
- DNS under control: we need access to change MX, SPF, DKIM, DMARC, and Autodiscover records.
- Licensing review: M365 Business Standard/Premium (up to 300 users), otherwise Enterprise.
- Source Exchange version: the supported path is from Exchange 2013+. Older versions require an intermediate upgrade.
- Mailbox size: mailboxes over 100 GB should be cleaned up (archived) beforehand.
DNS and SPF/DKIM/DMARC: the heart of every migration
Incorrectly set DNS records after migration are the #1 reason for rejected mail. Prepare:
- MX record pointing to Exchange Online (tenant-specific).
- SPF: `v=spf1 include:spf.protection.outlook.com -all`.
- DKIM: enabled in the Exchange Online admin center for both selectors.
- DMARC: start with `p=none` for monitoring, later `p=quarantine`.
- Autodiscover CNAME to `autodiscover.outlook.com`.
Realistic timeline for an MSP with 30 users
- Week 1: inventory, plan, licenses, DNS TTL set to 300 s.
- Week 2: tenant setup, MFA, security policies, pilot migration of 3 mailboxes.
- Week 3: batch migration of remaining mailboxes (overnight).
- Week 4: MX switch, Outlook client configuration (Autodiscover), inbound/outbound mail check.
- Week 5: decommissioning of the old Exchange server (if hybrid).
- What happens to old PST archives?
- PST files can be imported into Exchange Online via the Import service (for larger volumes) or the Outlook Import wizard. We recommend converting them to an online archive because corrupted PST files are the most common source of mail loss.
- Is there a risk of losing mail during migration?
- No, if the process is well-prepared. Mailboxes are first fully synchronized, then only the differences (delta sync). The MX switch is the final step once all data is already in the cloud.
- What about Public Folders?
- Public folder migration is a separate process. For small quantities (up to 500 GB, up to 250,000 folders), it is feasible using Microsoft scripts. For larger environments, it makes sense to consider migrating to Teams/SharePoint instead of Exchange Online public folders.
- Do I need MFA immediately?
- Yes. Exchange Online without MFA is dangerous – phishing campaigns will check your new accounts within hours. Enable MFA before the first migration.
- How much does a migration for 30 users cost?
- Depends on the method. Cutover: 20–30 consulting hours. Staged: 40–60 hours. Hybrid: 80+ hours. Add the monthly M365 license subscription cost.
Related posts
Business Continuity Plan: What a BCP for SMEs Must Include
What do we do if nothing works tomorrow morning? A 10-page BCP is all you need.
IT SupportIT Infrastructure Documentation: What Needs to be Recorded and Why
If it isn't documented, it doesn't exist. The minimum documentation scope every company needs.
CybersecurityTwo-Factor Authentication: Implementation Without Employee Resistance
MFA stops the vast majority of stolen password attacks. Learn how to deploy it quickly and without complaints.
