Cross-tenant mailbox migration: Best practices from the field

‍TL;DR: Mailbox migrations break on the things around the mail: delegate permissions, compliance settings that don't match, and licenses that don't fit the mailbox. Inventory first and batch connected mailboxes together so access doesn't break. Rebuild your compliance and mail hygiene config in the target tenant before you move anything.

‍

Cross-tenant mailbox migration sounds simple. You're moving email from one place to another. But the mail itself isn't what breaks. It's everything attached to it: delegates who lose access, retention policies that don't exist in the target tenant, licenses that can't hold the mailbox size. These are the details that generate helpdesk tickets.

The more you plan, the better the results. That's not a motivational poster. It's the difference between a quiet Monday morning and an inbox full of "my Outlook doesn't work" messages. For a broader view of the migration process, check out the Exchange Online migration guide.

Today, we're covering cross-tenant mailbox migration best practices: tricky areas like shared mailboxes and delegates, permissions, SMTP relay for your multi-functional devices, and compliance settings that need to match before cutover. Let's get into it.

‍

What should you inventory before a mailbox migration?

Inventory every mailbox and its size before you move anything.

The Get-MailboxReport.ps1 community script can generate an export of all mailboxes in your source organization. It's best suited to older on-premises Exchange environments. This includes room mailboxes and resource mailboxes, plus sizing information. Use the output to create a CSV file for new mailboxes in the target environment and a mapping list that connects source to destination.

Mailbox size affects licensing. If a user only needs webmail, you might assume a Microsoft 365 F3 license is fine. But an F3 license can't hold a 2-3 GB mailbox. I ran into this in my last migration: users with F3 licenses had mailboxes between 2 and 3 GB. Size the license to the mailbox, not the user's role.

Item count matters more than total size. A 10 GB mailbox with 10,000 larger items migrates much faster than one with 100,000 small items. Unfortunately, there's no universal strategy for batching these. Migration performance depends on too many factors to offer one-size-fits-all guidance.

‍

Do mailbox permissions survive a cross-tenant migration?

Not reliably. Cross-premises permissions can work, but it's not guaranteed.

Export all mailbox delegates from your source organization using Find-MailboxDelegates. This Microsoft FastTrack community script helps you export delegates and is most relevant when the source is on-premises or hybrid Exchange. The output shows relationships between mailboxes: managers and their assistants, for example.

Group and migrate these mailboxes together. Assistants usually have permissions on their managers' mailboxes. If you split them across migration batches, expect helpdesk tickets. Keeping connected mailboxes together during migration saves you trouble on cutover day.

Get a clear picture of all applications that use email. Some need an SMTP relay server in Microsoft 365 or on-premises. Modern applications log in directly to Exchange Online using Microsoft Graph. For those, you'll need to create and configure an App Registration in Microsoft Azure.

Using a third-party tool? Make sure you've got the keys to the castle. ShareGate's migration tool requires global admin or Exchange admin permissions at both source and destination. The tool must also be granted consent on your tenant.

‍

What compliance settings need to match between tenants?

Match the target tenant's compliance config to the source before you move.

Compliance and security cause major headaches in cross-tenant migrations. When compliance is configured in your source environment, the target environment must match before cutover.

This applies to mailboxes and archive mailboxes, including Retention Policy Tags and Retention Policies. You don't want helpdesk tickets from users whose mail "disappeared" into an archive mailbox they didn't know existed.

Other factors to consider:

• Litigation hold and the accompanying inactive users
• Data Loss Prevention (DLP) policies
• Digital Rights Management (DRM) configuration
• Message encryption. Office 365 Message Encryption (OME) was deprecated on July 1, 2023 and replaced by Microsoft Purview Message Encryption.

For security, look closely at Multi-Factor Authentication (MFA) and Conditional Access Policies. These affect users before and after migration. They can also affect your migration tool. What happens: the tool tries to log on to source or target, but the logon stalls on an MFA request. Or it comes from a location Conditional Access doesn't allow. Either way, your migration stops.

‍

What needs configuring in the target tenant first?

Rebuild the target tenant's mail flow and hygiene config before migrating.

Before moving mailboxes, confirm the Exchange configuration in your target tenant is finished. Set up your Autodiscover record, MX record, SPF record, DKIM, and DMARC record. For DNS guidance and validation tools, see the Exchange Online migration guide.

Microsoft 365 uses Exchange Online Protection (EOP) for message hygiene. Before starting the migration, recreate all message hygiene configurations from the source environment in the target. There's no Microsoft tool to help you with this. For larger environments with complex configurations, expect this to take time.

Don't forget any third-party signature and disclaimer solutions you're using. Those need to come along too.

‍

Why do mailbox migrations run slower than expected?

Throttling and Outlook cache rebuilds are the usual culprits.

Network performance can limit on-prem mailbox migrations. For cross-tenant migrations, it's less of an issue. But you need to know about throttling policies in Exchange Online. To protect the platform, network throughput is limited. For large migrations (thousands of mailboxes, multiple terabytes), contact Microsoft support to temporarily lift throttling policies. See the Exchange Online migration guide for more on the support request process.

Outlook is the other culprit during a cross-tenant migration. When you migrate, Outlook needs a new profile. It generates a new .OST file for its cache. That means all mailbox contents get downloaded to the Outlook client from scratch.

One or ten mailboxes? Manageable. But imagine migrating 1,000 mailboxes over the weekend. Monday morning, all 1,000 Outlook clients start downloading simultaneously. That's a bandwidth problem you can't avoid. It's just how Outlook works.

‍

How do you prepare users for a mailbox migration?

Tell users what's changing and when, through the channels they already use.

Getting everyone on board is key. Users need to understand what's changing and what to expect. Will their experience stay the same? Do they have new features like Teams, OneDrive, or SharePoint? How can they make the most of them?

Keep users informed through newsletters and regular updates on your company's intranet. Share information about new features and how to use them. Set up an internal wiki with how-to guides. Create a status page on the intranet in case issues pop up.

Communication is the difference between adoption and resistance. Get it right, and users embrace the new environment instead of fighting it.