How to choose a Microsoft 365 migration tool

TL;DR: A Microsoft 365 migration tool moves identity, mailboxes, and workloads like SharePoint, OneDrive, and Teams into or between tenants. Choosing one comes down to five questions: what you're moving, how much data and risk are involved, whether one tool covers the full sequence, whether you get a pre-migration assessment and reporting, and how you're billed. Microsoft's free native tools fit small, single-workload moves, but they don't provision cloud-to-cloud identity, so most tenant-to-tenant projects need more.

You've got a migration coming, and Microsoft already hands you free tools. So the real question isn't "which tool is best." It's "what do I actually gain by paying, and which type of tool fits this project?"

Get that wrong, and you pay twice. You overspend on a platform you didn't need. Or you pick a free tool that leaves you manually moving things at 2 a.m. on cutover weekend.

The market doesn't make this easy. Confusing categories. Overlapping feature lists. Every vendor swears they're the answer. Meanwhile, you just want to move mail, files, and users without breaking permissions or blowing the timeline.

This guide skips the ranking. No "top 10." You'll get a decision framework instead: what you're migrating, where free tools stop, how native tools and third-party platforms compare, the criteria that actually matter, and how scale and edge cases change the math. Pick with confidence, not vibes.

1. Start with what you're actually migrating: identity, mail, and workloads

Every Microsoft 365 migration breaks into three layers: identity, mail, and workloads. Identity is broad. It's your Microsoft Entra ID users and groups, plus what's attached to them: passwords, MFA methods, app assignments, manager relationships, and on-premises attributes. No single tool moves every piece, so pin down which parts you actually need. Mail means Exchange Online mailboxes. Workloads mean SharePoint, OneDrive, and Teams.

The order matters more than people expect. Identity comes first. In a tenant-to-tenant move, unresolved identity is the top cause of failed mailbox moves, broken permissions, and duplicate users. Mail comes next. Workloads land last, on top of users who already exist.

So scope drives everything. Count your layers before you shop, because a tool that nails files but ignores identity solves a third of your problem.

The first fork in the road is simple. Does one tool cover all three layers, or are you stitching a mail tool to a files tool to a spreadsheet full of user mappings? ShareGate Migrate runs the full identity → mail → workloads sequence in one tool. Users exist before their mailboxes and files land on them, so there are fewer moving parts and fewer surprises.

2. Native Microsoft tools vs third-party tools: what you gain by paying

Microsoft ships free migration tools built into Microsoft 365. They cover real ground: SharePoint, OneDrive, file shares, and mail. What they don't cover is the cloud-to-cloud identity layer that a tenant-to-tenant move depends on.

Start with what's actually free. The SharePoint Migration Tool (SPMT) moves on-premises SharePoint Server and file shares into SharePoint and OneDrive. Migration Manager is included with Microsoft 365, no separate license required. You'll find it in the SharePoint Admin Center. It moves file shares, Google Workspace, Box, Dropbox, and Egnyte. SharePoint Server content uses SPMT, not Migration Manager.

For mail, Exchange Online offers several native mailbox migration types: cutover, staged, hybrid, and IMAP. The hybrid path also has an Express option, also called Minimal Hybrid. Pick the one that matches your source and cutover plan.

The SharePoint Migration Tool: free, with SMAT on the way out

The SharePoint Migration Tool (SPMT) is free, and it's the native tool for moving SharePoint Server and file shares into SharePoint and OneDrive. The current version, 4.1, carries the built-in assessment introduced in version 4.0, which scans your source before you migrate.

That built-in scan replaces the old standalone SharePoint Migration Assessment Tool (SMAT), which reaches end of support on October 1, 2026. Use the SPMT scan instead. If you're still reaching for SMAT, stop.

Here's where native tools stop. Microsoft doesn't offer a native tool that provisions or migrates Entra ID user-account objects (passwords, MFA, app assignments) from one tenant to another the way third-party tools do. Cross-Tenant Identity Mapping (CTIM) automates identity attribute mapping onto target objects, but those target accounts have to already exist. You create them separately first. Microsoft's cross-tenant mailbox migration moves Exchange Online content between tenants too. But it needs a paid per-user add-on license called "Cross Tenant User Data Migration."

So what does paying add? Pre-migration assessment, throttling control for large jobs, validation reporting, and one view across mail, files, and users. Third-party options like ShareGate Migrate fold the identity step into that same flow. When is free genuinely enough? Small, single-workload moves within a single tenant, with no cloud-to-cloud identity to sort out. "Free" stops being free the moment you're rebuilding user accounts by hand across two tenants.

3. Native tools and third-party platforms, side by side

There are really two options: Microsoft's free native tools, and paid third-party platforms. Native tools are built in and handle single-workload moves. Third-party platforms cover more of the identity, mail, and workloads sequence in one place, with planning and reporting native tools don't have. Neither is "best." The right one depends on your project.

The table below is verdict-free on purpose. Read across the row that matches your scope, not down a column looking for a winner.

Two things the table can't show, so we'll say them plainly. First, third-party platforms aren't interchangeable. Some cover the full identity, mail, and workloads sequence in one tool. Others focus on mailboxes, or add coexistence and directory sync for phased mergers. Identity migration itself isn't unique to ShareGate. AvePoint, BitTitan, and Quest handle identity, too. What ShareGate leans on is the single-tool, integrated sequence: identity, mail, and workloads in one flow, rather than handing off between products.

Second, "a tool for MSPs" isn't a separate category. MSPs run their client migrations on these same platforms. The real question is licensing, and plenty of vendors, ShareGate included, offer a partner program built for multi-tenant work.

4. The selection criteria that actually matter

Selection criteria are the specific capabilities you test a tool against before you buy. For a Microsoft 365 migration, seven carry the weight. Here they are as a checklist you can lift straight into your own evaluation.

• Full-sequence coverage: so one tool moves identity, mail, and workloads in the right order instead of three tools fighting for the handoff.
• Pre-migration assessment and conflict detection: so you catch identity gaps and blockers before anything runs, not during cutover.
• Throttling control and concurrency: so large jobs run in parallel without tripping Microsoft's limits.
• Incremental migration, scheduling, and re-runs: so you sync deltas and retry failures without starting from zero.
• Permission and metadata fidelity: so your security posture and file history survive the move intact.
• Reporting and validation: so you can prove what moved and hand stakeholders evidence, not assurances.
• A licensing model that fits the project: so a two-month move doesn't lock you into a bad annual deal.

Notice how identity shows up as a workflow, not a bragging right. The question isn't "does it do Entra ID." It's "does identity run in the same sequence as mail and workloads, so users exist before their content lands."

ShareGate Migrate covers this checklist with a planning view that surfaces identity gaps and conflicts before anything runs, concurrent migrations, permission and metadata fidelity, validation reporting, and unlimited re-runs on a flat annual license with no data caps. One honest caveat: it's a desktop application, not a full cloud console. If a browser-based control plane is a hard requirement, weigh that early.

A quick scorecard for your shortlist

Score any tool against these before you buy. More yeses, better fit.

• Does it move identity, mail, and workloads in one tool?
• Does it flag identity conflicts before cutover?
• Can it run migrations concurrently to beat throttling?
• Does it support unlimited re-runs and incremental syncs?
• Does it preserve permissions and metadata?
• Can it prove what moved with validation reporting?
• Does its licensing match your project length?

5. Scale and risk: choosing for large or complex migrations

Large or complex migrations are the ones where free tools quietly run out of road. Think 5,000-plus users, mergers, tenant consolidations, and multi-wave cutovers. At this size, small inefficiencies turn into weekend-killing problems, and identity is the first thing to break.

For a migration this size, prioritize these, in order:

1. Identity first: provision and map users before anything else, since unresolved identity is the top cause of failed mailbox moves and duplicate users.
2. Pre-migration assessment: detect conflicts and blockers before cutover, not during it.
3. Concurrency and throttling control: move objects in parallel without tripping Microsoft's limits.
4. Wave planning: cut over in incremental waves instead of one risky big-bang move.
5. Validation reporting: prove what moved and hand stakeholders the evidence.

Native tools strain at this scale. You're managing throttling, waves, and validation by hand across thousands of objects, with no cloud-to-cloud identity provisioning to lean on. For enterprise migrations, consolidated third-party platforms run the whole sequence in one place instead of leaving you to stitch it together.

The standout is the sequence itself, run in a tool trusted by 100,000+ IT pros. Identity, mail, and workloads run in one tool, in one order. The identity step feeds the mail and workload steps with no separate handoff. ShareGate's Entra ID migration is in preview, available to Pro and Enterprise customers, and it covers users, security groups, Microsoft 365 groups, group memberships, and license assignment. A few honest limits, up front: it's cloud-to-cloud only. It doesn't migrate passwords, so users reset on first sign-in. It also doesn't touch manager relationships, on-premises attributes, device or workstation objects, or on-prem Active Directory. Plan for those, then let the tool handle the volume.

6. Special cases: MSPs, government cloud, and mixed sources

Some projects carry constraints that reshape the whole decision: MSPs running repeat migrations, government cloud tenants, and non-Microsoft sources like Google Workspace or Box. Each one changes what you should prioritize.

For MSPs and consultants, licensing is the deciding factor. A per-user model that made sense for one big move can wreck the margin on ten small ones. Look for terms that support multi-tenant work and repeat projects, and check the vendor's partner program before you standardize. Comparing options head-to-head? We keep ShareGate vs BitTitan and ShareGate vs Quest pages for exactly this.

Government cloud is its own animal. GCC, GCC High, and DoD tenants have requirements that not every tool meets. Confirm your chosen tool supports your specific cloud environment before you commit. Don't assume commercial-cloud support carries over.

For mixed sources, Migration Manager covers file shares, Google Workspace, Box, Dropbox, and Egnyte natively, and consolidated platforms cover Google Workspace and file shares too. ShareGate is honest about its edges here. It doesn't migrate Dropbox as a direct source (there's a file-share workaround), and it doesn't move Google Groups, Chat, or Forms. It also isn't a coexistence, GALSync, or directory-sync tool the way Cloudiway is. Know your sources, and you'll know which category to shortlist.

[CTA CARD: Large or complex migration coming up? "See what one tool for your whole Microsoft 365 migration looks like" — link to demo at https://sharegate.com/microsoft-migration]

Where to go from here

Run your own project through the checklist. Count your layers: identity, mail, workloads. Size the volume and the risk. Decide whether one tool or three fits the job, and whether your licensing matches a project or a program. That's a defensible shortlist, built on your scope instead of someone's ranking.

If your move crosses tenants and touches identity, mail, and files, one tool for the whole sequence saves you the handoffs that break at cutover. See what a tool for your whole Microsoft 365 like ShareGate Migrate migration looks like.

And picking the tool is only half of it. A good migration is a rare moment of clarity, because you've just seen exactly what's in your tenant. Keep it clean now, and it stays ready for AI and Microsoft Copilot. Migration gets you there clean. Governance keeps it that way, which is where ShareGate Protect picks up with continuous Microsoft 365 governance.