Microsoft 365 Migration Readiness Gate: 12 Checks Before You Cut Over

A migration that goes wrong almost always failed one of these rows before the first mailbox moved. Print the table, put a name against each row, and treat an empty "passed on" column as a reason not to book the cutover.

The rule for the whole gate: a row passes when its owner signs it, not when IT believes it. Rows 1, 4 and 12 belong to the business, and they are the three that most often stay open the longest.

Decide first whether the tenant will be cloud-only or synchronized from on-premises Active Directory. For an organization with no application that still needs a domain controller, cloud-only is simpler and removes a server. If Active Directory stays, Microsoft Entra Connect synchronizes it, and Microsoft's prerequisites (January 2026) are concrete:

• Active Directory schema version and forest functional level of Windows Server 2003 or later, with a writable domain controller; read-only domain controllers are not supported.
• A server on Windows Server 2025 or 2022 (Microsoft's recommendation), with .NET Framework 4.6.2 or later and TLS 1.2 available.
• The built-in SQL Server 2019 Express LocalDB has a 10 GB limit, enough for about 100,000 objects; larger directories need a full SQL Server.
• An account holding the Global Administrator or Hybrid Identity Administrator role, assigned directly rather than through a group.

Pass condition: every user's UPN suffix is a public domain added to the tenant, not a .local name, and every UPN matches the primary email address. That one attribute decides whether Outlook, Teams and OneDrive sign in cleanly on day one. Entra ID P1 is $7.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list) if Conditional Access is needed outside Business Premium.

Add the domain to the tenant weeks before cutover; proving ownership is one TXT record and changes nothing about mail flow. Document the current MX, SPF, DKIM and DMARC records, and lower the MX time-to-live to 300 seconds a week ahead so the cutover change propagates in minutes.

The method follows the source system and the mailbox count. Our method-by-method guides carry the Microsoft limits for each; the table is the decision.

Two Microsoft facts shape the choice. Microsoft's FastTrack benefit covers tenants with 150 or more licenses on an eligible plan, including Microsoft 365 Business Premium, E3 and E5, and includes data and email migration assistance at no additional charge for the life of the subscription; below 150 licenses, the Microsoft-sponsored programs in free Microsoft-funded migration are the route. And Microsoft's roadmap lists a unified Google Workspace migration experience in the Microsoft 365 admin center, Gmail and Google Drive from one page with a guided flow for tenants under 1,000 users (roadmap item 470139). The choice between cutover, staged and hybrid for your own Exchange Server is in Exchange Server to Exchange Online: cutover vs staged vs hybrid.

Buy the licenses before the migration, assign them before the mailboxes land, and reclaim the surplus 30 days after. Microsoft list price, October 2026 price list, per user per month on an annual commitment, with the month-to-month price where it differs:

Pass condition: a persona map (office, frontline, shared mailbox, executive, external contractor) with a plan against each, and no persona on a plan it does not use. The month-to-month column is for the migration window only; move to annual once the headcount is stable. The plan optimizer builds the persona map from your user list, and the licensing patterns that cost small businesses the most are in how companies overpay on Microsoft 365.

File migrations fail on limits that are easy to check in advance. Microsoft's SharePoint and OneDrive limits that bite during a move:

• The full path, from the site URL to the file name, cannot exceed 400 characters. A deep file share under a long site name hits this on day one; shorten site names before the move and flatten the deepest trees.
• A single site or OneDrive is capped at 5 TB or 1 million items, counting files, versions and folders. Split a large share into several sites by department.
• A file name that was legal on a Windows share is not always legal in SharePoint; the scan report from the migration tool lists the offenders.

Pass condition: a scan report with zero blocking items, an ownership map (which department owns which library), and a decision per share: SharePoint for team documents, OneDrive for personal folders, Azure Files for the shares an application needs, and the archive for the rest. SharePoint Online migration from a file share as-is is $4,500 per server; personal document migration to OneDrive is $50 per seat plus a $300 tenant fee. What to move and what to leave behind is in file server to SharePoint and OneDrive migration.

Windows 10 reached end of support on 14 October 2025, and year one of the commercial Extended Security Updates program ends on 13 October 2026. A migration is the wrong moment to discover that a third of the fleet cannot run the new Outlook or enroll in Intune. Pass condition: every device is on Windows 11, or holds a year-two ESU license with an exit date, or is on the replacement list with a delivery date. The sort is in Windows 10 ESU year one ends 13 October 2026.

Windows 11 requires a 1 GHz or faster processor with two or more cores on a compatible 64-bit processor, 4 GB of RAM, 64 GB of storage, UEFI firmware that is Secure Boot capable, and TPM 2.0. Devices that pass are enrolled in Intune through Windows Autopilot or an in-place enrollment, and the compliance policy that Conditional Access will enforce is built before cutover. Intune Plan 1 is $8.00 per user per month on an annual commitment and is included in Business Premium and E3. Intune initial setup for Windows device management is $6,500 per project; the Group Policy objects that do and do not translate are listed in Group Policy to Intune migration.

The first week on a new tenant is when attackers test it, because every user is expecting prompts and new sign-in pages. Pass condition for check 8: multifactor authentication enforced for every account, Conditional Access policies that block legacy authentication and require MFA from everywhere, two break-glass accounts excluded from those policies and stored offline, Defender for Business ($3.00 per user per month on its own, or included in Business Premium) deployed to enrolled devices, and audit logging confirmed on. The policy set is in Conditional Access policies every business should have; Microsoft 365 Security 30 Days Service at $2,000 per project builds it before the first mailbox lands.

Pass condition for check 9: a full backup of the source system taken within 24 hours of cutover and one mailbox restored from it as a test, and a decision on Microsoft 365 backup for after the move, because Microsoft's retention is not a backup. Microsoft 365 Backup (native) setup and management is $2,950.

Applications (check 10). List every device and application that sends email: multifunction printers, the accounting system, the website contact form, monitoring alerts. Each needs an authenticated SMTP path in Exchange Online or a relay, tested before cutover. List every application that reads mail or calendars through an API and confirm its vendor supports Microsoft 365.

Pilot (check 11). Migrate five to ten users across departments, including one executive with a delegate and one heavy mobile user, a week before the main move. Pass condition: each pilot user signs a one-line acceptance covering mail, calendar, mobile, Teams and files.

Rollback and communications (check 12). Rollback for a cutover is a DNS change back to the old MX and a known data-loss window; write down who makes the change, how long it takes, and what mail is lost. Tell users the date, the sign-in change, the MFA registration they must complete before the weekend, and the support channel. Pass condition: the message has gone out, and MFA registration is above the target you set, measured in the Entra admin center the day before cutover.

After the weekend, post-migration support for admins at $900 per project covers the first two weeks of questions, and a tenant health check, at no charge, confirms the tenant matches the baseline 30 days later. What the finished tenant should look like is in what a clean Microsoft tenant should look like in 2026.

How long does a Microsoft 365 migration take for a small business?

Four to six weeks for 10 to 100 users: two weeks to pass the gate (identity, domain, licenses, security), one week for the pilot, one cutover weekend, and two weeks of post-migration support. The gate, not the data transfer, is the long part.

Which Microsoft 365 plan should we buy for a migration?

Microsoft 365 Business Premium at $22.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list) for office staff under 300 users, because it includes Intune, Entra ID P1 and Defender for Business; Business Basic at $7.00 or Exchange Online Plan 1 at $4.00 for mail-only roles; Microsoft 365 E3 at $39.00 above 300 users.

Do we need Entra Connect?

Only if an application or a file server still needs on-premises Active Directory. If nothing does, build the tenant cloud-only and retire the domain controller. If something does, the prerequisites are a writable domain controller, a server on Windows Server 2022 or 2025, and a Global Administrator or Hybrid Identity Administrator account.

Will Microsoft pay for our migration?

Microsoft funds some migrations: FastTrack assistance for tenants with 150 or more eligible licenses, and partner-delivered Microsoft-sponsored migrations for smaller tenants that qualify. Where neither applies, our cutover Exchange Online migration is $2,500 plus $35 per mailbox, quoted in writing before work begins.

What breaks most often after cutover?

Printers and applications that send email without authentication, mobile devices with old profiles, delegate access to shared calendars, and users who did not register MFA before the weekend. All four are checks 8, 10 and 12 in the gate.

Should we migrate files and email at the same time?

No. Move email on one weekend and files two to three weeks later, after mail and sign-in are stable. The exception is a tenant-to-tenant move where the domain cutover forces both at once.

• Microsoft Entra Connect: Prerequisites and hardware — Microsoft Learn, updated 2026-01-16, checked 2026-10-11
• FastTrack eligibility — Microsoft Learn, checked 2026-10-11
• Microsoft 365 roadmap, item 470139: Microsoft 365 admin center unified Google Workspace migration — Microsoft, status "In development" with a March 2025 target, checked 2026-10-11
• Cross-tenant OneDrive migration (path and size limits) — Microsoft Learn, updated 2025-08-14, checked 2026-10-11
• Windows 10 end of support — Microsoft, checked 2026-10-11
• Windows 11 specifications and system requirements — Microsoft, checked 2026-10-11