Moving your business to Microsoft 365 — or from an old, neglected setup to a properly run one — is one of those projects that goes beautifully or badly depending almost entirely on the preparation. The technology is mature and reliable; the disasters come from skipped steps. This is a practical checklist to migrate without losing email, breaking access, or discovering a problem after everyone has switched over.
It pairs with our Microsoft 365 service and our licensing guidance.
Before you move: plan and licence
The work that prevents disasters happens before anything migrates. Take stock of what you have: every mailbox, every shared address, the files and the systems that depend on them. Decide the licence each role actually needs rather than buying one plan for everyone — getting this right up front avoids both overspending and under-protecting people. And understand the commitment terms before you order, because Microsoft’s licensing has rules about how long you are locked in that are far easier to plan around than to discover later.
Get the foundations right
- Verify your domain and plan the DNS cutover. Email delivery depends on DNS records; changing them carelessly is the classic way to lose mail during a migration.
- Set up SPF, DKIM, and DMARC so your mail is trusted from day one and not landing in everyone’s spam.
- Decide who holds admin access — you should own the tenant, with your provider given access, not control.
- Plan the data migration — how existing email and files move across, and how you confirm nothing was lost.
All at once, or in stages?
For a small team, a single well-planned cutover over a weekend is usually simplest. For a larger or busier business, a staged move — mailboxes in batches, files alongside, with both systems briefly running in parallel — lowers the risk of a bad day hitting everyone at once. There is no universally right answer; the choice turns on how many people you are moving, how much data, and how much downtime the business can absorb. What matters is that the approach is chosen deliberately rather than being whatever happens by default.
Turn the security on from the start
A migration is the ideal moment to set security up properly, because you are configuring everything anyway. Enable multi-factor authentication for every user, protect admin accounts especially, and — if you are on Business Premium — switch on the device management and Conditional Access you are paying for. Doing this during the move costs almost nothing extra; bolting it on months later, after a scare, always costs more and disrupts people who had settled in.
The cutover and the days after
Schedule the final switch for a quiet window, tell your team what to expect, and have someone on hand for the inevitable “where did my folder go?” questions. A little training — where things live now, how sharing works — turns grumbling into adoption. For the first week, watch mail flow and access closely so any small issue is caught immediately rather than festering. A migration is not done at cutover; it is done when the team is working comfortably and nothing has quietly broken.
The mistakes that cause the disasters
Almost every bad migration traces back to the same few errors. Cutting the DNS over before mail has finished moving, so messages bounce or vanish mid-switch. Letting the provider own the tenant instead of the business, so you cannot get back in if the relationship ends. Buying one licence tier for everyone, then either overpaying for staff who need little or leaving key people under-protected. Skipping the security setup “for now” and never going back to it. And moving data with no verification step, so nobody notices the missing archive until someone needs it months later. None of these are technically hard to avoid — they are simply what gets skipped when a move is rushed.
The practical next step
If you are planning a move — or you migrated in a hurry once and suspect it was never finished properly — a short review will show what is in place and what was skipped. For the licensing decisions behind it, our Microsoft 365 NCE whitepaper covers the terms that catch businesses out.
Published 16 June 2026. Last updated 16 June 2026.