Originally published August 18, 2026 · Updated August 13, 2026
If you’re still running email through an aging on-premises Exchange server, a legacy Google Workspace account, or a consumer Gmail setup, you’ve probably already been told it’s time to migrate to Microsoft 365. But what does that actually look like for a small business?
The short answer: done right, an M365 migration is one of the highest-ROI IT investments a 5–75 user business can make. Done wrong, it means a lost week of email, corrupted calendar data, and employees locked out of shared files at the worst possible time.
This guide walks through exactly what the migration process looks like, what it costs, and the decisions that determine whether yours goes smoothly or sideways.
What Is a Microsoft 365 Migration?
A Microsoft 365 migration moves your business’s email, calendars, contacts, files, and collaboration tools from wherever they live today — on-premises Exchange, Google Workspace, GoDaddy email, Yahoo Business, or another provider — into Microsoft’s cloud-hosted platform.
M365 (formerly Office 365) gives your team:
- Exchange Online — business email with a custom domain (@yourcompany.com)
- SharePoint + OneDrive — cloud file storage with version history and access controls
- Teams — chat, video calls, file sharing, and project collaboration
- Microsoft 365 Apps — Word, Excel, PowerPoint, Outlook (desktop + mobile)
- Defender for Business — built-in endpoint protection and email security
- Intune — device management and mobile application policies
- Entra ID (formerly Azure AD) — identity and single sign-on
For most small businesses, the core migration is about email and files. Everything else is a phased buildout after cutover.
Why Small Businesses Migrate to Microsoft 365
The most common reasons SDTEK sees businesses kick off a migration:
1. End-of-life hardware. On-premises Exchange servers typically run for 5–7 years before hardware failure risk, performance degradation, and end-of-support status make them untenable. Exchange 2013 reached end-of-life in 2023, and Exchange 2016 reached end-of-support in October 2025.
2. Windows 10 end-of-life pressure. Windows 10 reached end-of-support in October 2025, so many businesses are combining an overdue workstation refresh with a broader cloud modernization project. Microsoft 365 Business Premium includes the device-management tools needed to support Windows Autopilot deployments, making this a logical time to consolidate.
3. Security posture. On-premises email is a high-value attack target. M365 with Defender for Business, Conditional Access, and MFA enforced across the tenant is substantially more secure than a self-managed Exchange environment.
4. Remote/hybrid work. Post-2020, the “files on the server” model breaks down. M365 + SharePoint/OneDrive gives any employee access to company files from any device without requiring VPN.
5. Software licensing cost clarity. Per-user monthly pricing (6–22/user/month depending on tier) is predictable. On-premises software assurance, CAL licensing, and server maintenance are not.
The 5 Migration Phases
Phase 1: Discovery and Planning (Week 1–2)
Before anything moves, your IT team (or MSP) needs a complete picture of your current environment:
- Email platform audit: Exchange version, mailbox count, total mailbox size, shared mailboxes, distribution lists, public folders
- Domain DNS access: You’ll need to modify MX records, SPF, DKIM, and DMARC at cutover — confirm who controls your DNS
- Licensing decision: M365 Business Basic (6/user/mo)vsBusinessStandard(12.50) vs Business Premium ($22) — determined by whether you need desktop Office apps, advanced security, or MDM
- Data volume: Large mailboxes (50GB+) take longer to migrate; plan accordingly
- Legacy dependencies: Any on-premises apps that authenticate against your Exchange server, shared calendar or room booking systems, or line-of-business software that sends email through Exchange SMTP
Deliverable: Migration runbook with timeline, rollback plan, user communication templates, and cutover window.
Phase 2: Tenant Setup and Pre-Migration (Week 2–3)
Before migrating a single mailbox, the M365 tenant gets hardened:
- Domain verification: Prove ownership of your custom domain to Microsoft
- Security baseline: Enable MFA for all admin accounts; configure Conditional Access policies; configure Defender for Business baseline policies
- Email authentication: Set up SPF, DKIM, and DMARC records (critical for deliverability and anti-spoofing)
- License assignment: Purchase and assign licenses to all users
- Test mailbox migration: Migrate 2–3 pilot mailboxes and validate email flow, calendar sync, and Outlook connectivity before touching production
This phase is where most DIY migrations skip steps. Skipping DKIM/DMARC setup means your outbound email lands in spam at receiving domains. Skipping MFA means you’re migrating to a less secure environment than you left.
Phase 3: Mailbox Migration (Week 3–4)
The actual data move. For most small businesses, this uses one of three methods:
Cutover Migration (< 150 mailboxes) All mailboxes move at once. Fastest approach. Works well for businesses under 150 users with minimal migration complexity. Takes 2–4 days for the initial sync, then a 1–4 hour cutover window where DNS is updated.
Staged Migration (> 150 mailboxes) Mailboxes migrate in batches over weeks. Users shift to M365 in groups. Reduces risk but extends the transition period.
IMAP Migration (from Google Workspace or other providers) Used when migrating from non-Exchange platforms. Moves email only — calendars and contacts require a separate export/import process. Tools like Google Workspace Migration for Microsoft Outlook (GWMMO) are available but require careful sequencing.
During migration:
- Users continue working on old platform (no disruption)
- Data syncs continuously in the background
- Final cutover = DNS MX record change (takes 0–72 hours to propagate globally)
Phase 4: Cutover and Validation (Cutover Day)
The cutover window is typically scheduled for a weekend morning (6–10 AM local time):
- Final mailbox sync — verify all data has replicated
- DNS MX record updated to point to Exchange Online
- Autodiscover records updated so Outlook clients automatically find M365
- Users reconfigure Outlook (takes 2–5 minutes per machine) or are pre-staged
- Old mail server set to relay-only mode (catches any mail sent to old MX during propagation)
- Validation: send test emails inbound and outbound, verify calendar sync, verify shared mailboxes, verify send-as permissions
Critical: Keep the old mail server alive for 72 hours after cutover to catch straggler email during DNS propagation. The most common cutover mistake is decommissioning too early.
Phase 5: Post-Migration Hardening (Week 5–6)
The migration itself is complete — now lock it down:
- Disable legacy authentication: Basic auth protocols (IMAP, POP3, SMTP AUTH) are the primary vector for credential stuffing attacks against M365 tenants. Disable them via Conditional Access policies once all clients are on modern auth.
- Configure email filtering: M365 Defender anti-phishing, anti-malware, and Safe Links/Safe Attachments policies
- SharePoint/OneDrive rollout: Train users, migrate key shared files from on-premises file servers, set permissions model
- Teams deployment: Replace whatever chat/call tool the team was using
- Backup configuration: M365 does not include a third-party backup. Configure Veeam, Backupify, or Datto SaaS Protection for email and SharePoint data
- MDM enrollment: Enroll company-owned devices in Intune for policy enforcement and remote wipe capability
Microsoft 365 Migration Costs
Costs vary significantly based on mailbox count, complexity, and whether you’re migrating from Exchange or a third-party platform.
| Scenario | DIY | With MSP |
|---|---|---|
| 10-user IMAP to M365 (from Google/GoDaddy) | $0 labor + licensing | 800–2,000 + licensing |
| 25-user on-prem Exchange cutover | $0 labor + licensing | 2, 000–4,500 + licensing |
| 50-user Exchange + file server migration | $0 labor + licensing | 5, 000–10,000 + licensing |
| 100-user complex hybrid migration | Not recommended | 12, 000–25,000 + licensing |
Licensing (per user/month):
- M365 Business Basic: $6/user/mo — Teams, Exchange Online, SharePoint/OneDrive, browser-based Office
- M365 Business Standard: $12.50/user/mo — adds desktop Office apps (Word, Excel, PowerPoint, Outlook)
- M365 Business Premium: $22/user/mo — adds Defender for Business, Intune MDM, Entra ID P1, Microsoft Purview
For most 10–50 user businesses, SDTEK recommends M365 Business Premium. The $9.50/user/mo premium over Business Standard adds enterprise-grade security (MDR-ready EDR, Conditional Access, device management) that would otherwise require separate security licensing.
Hidden cost if you DIY: Downtime. A failed or extended cutover at a 25-user firm at average $75/hour billing rate = $1,875 for a one-hour outage. For businesses where email is mission-critical (professional services, construction, healthcare), that math accelerates quickly.
5 Common Migration Mistakes (and How to Avoid Them)
1. Skipping email authentication setup. SPF, DKIM, and DMARC don’t migrate themselves — they’re built from scratch in DNS for your domain. Businesses that skip this step see outbound email landing in spam at major providers within days. Fix: configure all three before changing MX records.
2. Migrating without testing Autodiscover. Autodiscover lets Outlook clients find your Exchange Online server automatically. If it’s misconfigured, every user’s Outlook breaks at cutover and requires manual reconfiguration. Test with Microsoft’s Remote Connectivity Analyzer before cutover day.
3. Leaving legacy authentication enabled. M365 tenants with IMAP, POP3, or basic SMTP auth still active are actively targeted by credential stuffing attacks. Within weeks of migration, bots will attempt brute-force logins against every known email address in your domain. Block legacy auth via Conditional Access from day one.
4. Not backing up M365 data. Microsoft’s SLA covers service uptime — not accidental deletion, ransomware, or malicious insider actions. The default retention window for deleted items is 30–93 days, not a backup. Configure a third-party backup solution before decommissioning your old server.
5. Moving everything at once. Large file server migrations (terabytes of data) running concurrently with mailbox migrations cause network congestion, extended timelines, and user confusion. Phase the migration: email first, files after cutover is stable.
Do You Need an MSP for Your M365 Migration?
Straightforward migrations you can DIY:
- 1–5 users moving from consumer Gmail or Zoho to M365
- You have an IT person in-house with Exchange/M365 experience
- No on-premises server infrastructure
- Tolerance for some cutover disruption
Migrations where an MSP significantly reduces risk:
- 10+ users where email downtime has real revenue impact
- On-premises Exchange server with public folders, room calendars, or third-party integrations
- Compliance requirements (HIPAA, SOC 2, CMMC) where misconfiguration isn’t acceptable
- No internal IT resource with M365 admin experience
- Concurrent workstation refresh or Windows 11 migration
The value of using a managed IT provider for an M365 migration isn’t just the technical work — it’s the runbook, the rollback plan, the weekend cutover window staffed by someone who has done this 20 times, and the post-migration security hardening that keeps your new tenant from becoming a liability.
5 Questions to Ask Your MSP Before an M365 Migration
What does your migration runbook look like, and can I see a sample? A provider who has done this before has documentation. A provider who hasn’t will tell you they’ll figure it out.
How do you handle the cutover window, and what is your rollback plan? Every migration needs a defined go/no-go checkpoint and a documented path to revert if something breaks at 7 AM Saturday.
Do you configure SPF, DKIM, and DMARC as part of the migration scope? The answer should be yes, as standard.
What backup solution do you recommend for M365 data post-migration? If they say “Microsoft handles that,” find a different provider.
How do you handle licensing — do you pass through Microsoft pricing, or do you use a CSP relationship? MSPs purchasing through the CSP (Cloud Solution Provider) program can often offer better support SLAs and more flexible licensing management than purchasing direct.
What Comes After the Migration
A completed M365 migration is a foundation, not a destination. The businesses that get the most out of M365 treat it as a platform buildout:
- Year 1: Email + Teams + SharePoint in place; MFA enforced; Defender for Business active
- Year 1–2: Intune MDM for all endpoints; legacy VPN replaced with Conditional Access + ZTNA
- Ongoing: Security baselines reviewed quarterly; access reviews for departing employees; Power Automate workflows replacing manual processes
SDTEK’s quarterly vCIO reviews include M365 configuration audits — checking for licensing waste, stale accounts, admin account hygiene, and emerging policy gaps — as part of our standard TBR (Technology Business Review) process.
If you’re planning a move, review what managed IT services include, current managed IT pricing factors, and why MFA matters for every Microsoft 365 account. When you’re ready, contact SDTEK to discuss a migration plan and realistic cutover timeline.
