Pre-migration checks to prevent access issues and mail disruption

Pre-migration checks to prevent access issues and mail disruption

Why pre-migration checks matter for Raleigh SMBs

Define outcomes and risks up front to prevent access lockouts and email disruption that can damage revenue, customer trust, and compliance. Ready to get proactive IT support that prevents problems before they happen? check out our managed it services raleigh for 24/7 network monitoring, helpdesk support, and cybersecurity protection and get all the details. Align scope with Microsoft 365 across identity, email, endpoints, networking, and security.

Key facts at a glance:

  • Mailbox downtime target: <15 minutes per user.
  • Require 100% MFA coverage.
  • Pilot one site before broad rollout.
  • Success criteria and KPIs: zero critical incidents; <15 minutes of mailbox downtime per user; 100% MFA coverage; rollback tested.
  • Roles and authority: CEO or executive sponsor makes final risk decisions; operations manager manages change windows; MSP maintains runbooks and monitoring, with a documented after-hours escalation path.
  • Raleigh/Research Triangle realities: multi-site offices, hybrid schedules, and common frameworks (HIPAA, SOC 2, 21 CFR Part 11) mapped to controls.
  • Migration window: schedule outside peak sales and service hours; avoid month-end and clinic/production peaks; pilot a single site first.
  • Tools: validated discovery and migration tooling (Entra Connect, Exchange Online batches, SharePoint Migration Tool, Intune); define remediation for legacy or IMAP gaps.
  • Commercials: confirm budget guardrails, fixed-fee MSP model, SLAs, and change-request approval steps.

Environment discovery and inventory

  • Identity and domains: inventory Active Directory or other directories, verify Microsoft 365 domains (verified/unverified), document UPN formats, and DNS ownership.
  • Mail systems: identify Exchange, Google Workspace, IMAP servers, third-party gateways, journaling, and archiving.
  • Mailbox inventory: users; shared/resource mailboxes; delegates; aliases; forwarding; distribution lists; and nested groups.
  • Data and compliance: retention policies, legal holds, locations of PHI/financial data, and eDiscovery scope before any migration or deletion.
  • Apps and integrations: map SMTP relays, scanners, LOB apps, CRM/ERP, and marketing platforms that send email.
  • Devices, network, and security: Windows/macOS versions; Outlook versions/add-ins; mobile devices and MDM; firewalls, proxies, VPN, TLS inspection; site bandwidth; and remote-worker patterns.

Highlights:

  • Scope spans identity, mail platforms, mailboxes, compliance, integrations, and endpoint/network security.
  • Track owners and deadlines for every issue; remediate pre-cutover to maintain continuity across Raleigh and the Triangle.

Record each issue with an owner and due date. Remediate before cutover to prevent access issues and mail disruption across Raleigh and the Triangle.

Identity, domain, and authentication readiness

UPN Alignment

Align user principal names (UPNs) with the target email domain before cutover. Update the UPN suffix in on-premises Active Directory and verify it synchronizes to Entra ID. Misaligned UPNs and primary SMTP addresses trigger repeated prompts, cached profile problems, and user confusion. Test Microsoft 365 sign-ins after the change and note where usernames are hard-coded in scripts or apps. Communicate the maintenance window and plan to recreate profiles only when Outlook cannot remap automatically.

Domain Verification

Verify production and vanity domains in Microsoft 365 weeks in advance. Add the TXT record to prove ownership, then pre-stage MX, Autodiscover, and SPF changes for the cutover window. Remove unused or conflicting subdomains so accepted domains in Exchange Online remain clean. Pre-create DKIM DNS records and enable them after mail is routing to reduce spoofing risk. Use Microsoft 365 admin checks to confirm there are no outstanding domain setup issues.

Key readiness checks:

  • UPNs should match the primary SMTP domain to minimize sign-in prompts and profile issues.
  • Verify and stage DNS (TXT, MX, Autodiscover, SPF, DKIM) well before cutover.
  • Select and harden the identity sync method (PHS or PTA) and filter to active objects only.
  • Enforce Modern Authentication; disable legacy protocols and tightly control SMTP AUTH.
  • Require MFA for all accounts and maintain a monitored break-glass admin with offline credentials.

Connect Design

Choose cloud-only identities, Password Hash Sync (PHS), or Pass-through Authentication (PTA) with redundant agents. PHS suits most small environments and enables seamless sign-in with fewer components. PTA can meet strict sign-in requirements but needs high availability and monitoring. Filter OUs and attributes to sync only active users and groups, excluding service accounts and stale objects. Establish the source of authority and roll out in stages to prevent duplicate accounts.

Modern Authentication

Enforce Modern Authentication and disable legacy protocols like POP and IMAP wherever feasible. Microsoft has retired most basic auth endpoints, but tenants with exceptions remain targets. Inventory mail clients and upgrade Outlook to supported versions before the switch. For SMTP AUTH, enable it only for specific mail-enabled devices and, if possible, restrict by IP.

MFA Policies

Enable MFA for every account, including executives; use workload-specific credentials for service accounts where applicable. Run Conditional Access in report-only mode to assess impact before enforcing. Maintain a monitored break-glass Global Admin excluded from policies and store credentials offline. Require registration of MFA methods before enforcement, and enable number matching to reduce push fatigue. Review sign-in logs daily during rollout and set end dates for any exclusions.

Licensing strategy and mailbox mapping

Before cutover, finalize licensing, mailbox types, retention, and integrations to avoid access surprises and mail disruptions.

Quick facts

  • Shared mailboxes over 50 GB or requiring archive/hold must be licensed; otherwise keep them within unlicensed limits.
  • Group-based licensing in Entra ID streamlines consistent onboarding and offboarding.
  • Online Archive and auto-expanding archive help heavy email users avoid migration failures.
  • Map user personas to Microsoft 365 Business Premium, E3, or E5 based on security, compliance, and voice requirements; avoid over- or under-licensing.
  • Use group-based licensing in Entra ID for consistent, automated onboarding and offboarding.
  • Classify mailboxes (user, shared, resource, room). Keep unlicensed shared mailboxes within size and feature limits; assign a license if >50 GB or if archive or hold is required.
  • Set realistic mailbox quotas. Enable Online Archive and auto-expanding archive for heavy email users to prevent migration failures.
  • Apply retention labels and Litigation Hold before data moves to preserve chain of custody and meet regulatory requirements.
  • Validate Outlook add-ins, transport agents, and SIEM/archiving integrations in the target tenant.
  • Forecast the monthly run rate, including licenses, calling plans, MSP fees, and change controls; schedule optimization checkpoints tied to usage and security posture for Raleigh/Triangle teams.

Email system preparation to avoid downtime

Start by choosing the right migration method. Cutover suits small organizations that can handle a single weekend switch. Staged fits larger mailbox counts and a phased timeline. Hybrid Exchange preserves coexistence and calendar free/busy for months—ideal when you can’t disrupt shared meetings. IMAP moves only mail (no calendars or contacts), so use it only as a last resort.

Clean the source now, not during go‑live. Remove disabled and test accounts. Correct malformed SMTP addresses and invalid characters. Reconcile duplicate users across directories so Azure AD doesn’t create confusing shadow objects.

Quick planning highlights

  • Pick the migration path based on size, mailbox count, and coexistence needs.
  • Clean directories early to avoid duplicate/shadow objects in Azure AD.
  • Inventory delegation, shared resources, and mailflow rules so they can be rebuilt in order.
  • Phase DNS/auth updates (SPF, DKIM, DMARC) and pilot profile redirection before cutover.
  • Delegation: Export Send As, Send on Behalf, and Full Access. Map who opens which mailbox; otherwise assistants and shared workflows will break after cutover.
  • Public folders and shared resources: Inventory public folders, shared mailboxes, rooms, and shared calendars. Validate size and hierarchy depth. Decide which become shared mailboxes or Microsoft 365 Groups, and which truly remain public folders.
  • Mailflow: Document transport rules, connectors, journaling targets, disclaimers, and any mailbox forwarding. Recreate them in the correct order to keep compliance and approvals intact.
  • SMTP relay: Use authenticated submission to smtp.office365.com for apps that can sign in, or direct send via an Exchange Online connector for devices that can’t. Give scanners and apps dedicated accounts with least privilege and unique credentials.
  • DNS and auth: Update SPF without exceeding the 10‑lookup limit. Publish and enable DKIM. Roll out DMARC gradually—none, then quarantine, then reject—monitoring rua reports each step.
  • Autodiscover and profiles: Test profile redirection in a pilot. Use Outlook repair scripts where needed. Flip DNS when most users are offline.
  • Throttling: Respect Microsoft and source rate limits. Pre‑stage older mail, then run a short delta sync just before cutover.

Complete these checks 2 to 4 weeks before migration. Skip them and you risk access issues, NDRs, broken scanners, and a noisy Monday.

Endpoint, client, and app readiness

Quick facts

  • Modern authentication/OAuth is required across clients and LOB integrations.
  • Target a 3–6 month Outlook cache and maintain at least 15% free disk space.
  • Intune enrollment and app protection are key for mobile and BYOD scenarios.
  • Remote users need off-VPN guidance and correct split-tunnel access to Microsoft 365.
  • Office/Outlook: verify modern auth and Exchange Online compatibility; update to supported builds; use Monthly Enterprise or Current Channel.
  • Cached mode: configure 3–6 months; ensure 15%+ free disk space; rebuild oversized OSTs before migration.
  • Add-ins: validate mission-critical add-ins for modern auth and performance; remove deprecated COM/VSTO extensions.
  • Mobile: enforce device compliance; enroll corporate devices in Intune; apply app protection policies to Outlook/Teams for BYOD.
  • macOS: verify Outlook for Mac version, profile readiness, and local cache migration per user.
  • Remote users: publish off-VPN guidance; validate access to Microsoft 365 endpoints; correct split-tunnel rules.
  • Apps and accessibility: retest LOB apps using Graph/EWS/SMTP with OAuth; pre-stage language and accessibility packs.

Network, security, and resilience checks

Validate Microsoft 365 connectivity before migrating mailboxes. These checks help avoid failed sign-ins and sluggish mail flow.

Key points these checks address

  • Connectivity prerequisites: required URLs/IPs, ports, and adequate bandwidth.
  • Identity and security dependencies: TLS inspection exclusions, DNS readiness, and threat protection setup.
  • Operational readiness: continuity plans and centralized monitoring.
  • Permit the required Microsoft 365 URLs and IP ranges, prioritize Optimize endpoints, and exclude them from SSL inspection where recommended.
  • Firewalls and proxies: allow outbound 443/80 and protocols needed by Exchange Online and Intune; avoid rate limits or SSL inspection that introduce latency.
  • Establish bandwidth baselines (especially for branches), measure sustained upload capacity, and stagger migrations to prevent circuit saturation.
  • DNS: verify internal and external records (Autodiscover, MX, SPF), lower TTLs several days pre‑cutover, and resolve split‑brain DNS.
  • TLS inspection/auth: exclude Exchange Online, Entra ID, and Teams to prevent token issues and mTLS failures.
  • Threat protection: preconfigure Defender for Office 365 (Safe Links/Attachments), spam/phish defenses, and align mail flow rules.
  • Continuity: define mail spooling and queue monitoring, plus an incident communication playbook.
  • Monitoring: enable Message Trace, service health alerts, and SIEM forwarding prior to changes.

Change management, communication, and training

Identify accountable roles before changing DNS: executive sponsor, departmental business owners, helpdesk lead, and the MSP service manager. Map a RACI so approvals, tasks, and escalations are explicit. This keeps Microsoft 365 cutover decisions fast and reduces access issues.

Publish a user-facing communication timeline: a two-week pre-notice covering Microsoft 365 changes, licensing, and access; a 72-hour reminder with exact dates and any downtime; day-of cutover alerts; and a concise post-cutover tip sheet for Raleigh office staff and fully remote workers, whose steps differ.

Key deliverables to publish:

  • RACI with named owners and escalation paths
  • User communication timeline and post-cutover tip sheets
  • Pilot scope, feedback tracker, and finalized runbook
  • Support plan with SLAs and on-site escalation in the Triangle

Run a pilot first. Include executives, sales, and operations across varied devices and mail clients. Target 10 to 15 percent of users. Capture feedback in a shared tracker, adjust policies, add-ins, and enrollment steps, then finalize the runbook.

Provide quick guides for rebuilding Outlook profiles, mobile enrollment via Company Portal, MFA prompts and recovery methods, and self-service password reset. Offer Teams office hours the week before and after so people can quickly resolve setup issues.

Staff support for the week of cutover. Extend helpdesk hours to 7 a.m. to 7 p.m. ET, with after-hours on-call. Define escalation to on-site responders in the Triangle. Publish SLAs, for example a 30-minute first response and clear Priority 1 restoration targets.

  • Risk: DNS propagation. Mitigation: lower TTL 72 hours prior; verify MX, Autodiscover, SPF, and DKIM. Rollback trigger: MX unresolved by H+2; repoint MX and Autodiscover to pre-cutover values.
  • Risk: Microsoft 365 throttling. Mitigation: right-size batches; run off-peak; monitor Service Health. Rollback trigger: sustained failure rate over threshold; pause or roll back the latest batch.
  • Risk: Office add-in failures. Mitigation: inventory and test versions; update or disable in advance. Rollback trigger: critical add-in breaks; revert update channel or disable the add-in org-wide.

Set change-freeze windows around financial closes, seasonal peaks, and local Raleigh events to avoid business impact. Document go or no-go checkpoints with mail flow tests, Teams sign-in, OneDrive sync, and obtain written sign-off from business owners.

Dry runs, pilot validation, and the cutover runbook

Validate the plan in a test tenant and sandbox. Confirm Conditional Access, security defaults, and license assignment without impacting production. Run a small pilot: pre‑stage mailboxes; verify calendar sharing, delegate access, and end‑to‑end mail flow.

Key checkpoints to verify:

  • Pilot users can send and receive mail internally and externally without errors.
  • SPF, DKIM, and DMARC show correct alignment before and after cutover.
  • Representative devices sign in successfully and meet Intune compliance.
  • Identity sync: verify Entra Connect health and attribute flows; resolve UPN/proxyAddress conflicts.
  • Mail authentication: publish DKIM for a subdomain, set DMARC to p=none, and verify SPF/DKIM/DMARC alignment.
  • Cutover: freeze source changes, run final delta syncs, switch MX and Autodiscover, enable DKIM on the primary domain, and monitor queues.
  • Verification: test inbound/outbound flow, internal routing, external recipients, shared mailboxes, and transport rules.
  • Endpoints: trigger Outlook profile repair as needed, confirm mobile app sign-in, and validate Intune compliance.
  • Stabilization: track NDRs, phishing false positives, and performance; decommission legacy connectors/gateways safely.
  • After 30 days: tune policies, right-size licenses, and provide a concise report on incidents, savings, and security posture improvements.

Frequently Asked Questions

Confirm domain ownership and DNS registrar access; inventory users, groups, shared mailboxes, and permissions; validate Microsoft Entra ID sync, SSO, and an MFA enrollment plan; map licenses to required features and assign trial seats for pilots; verify device compliance and supported Outlook/Office versions; document Conditional Access policies and third-party integrations; back up critical data, export mailbox sizes, and test a pilot group of Raleigh-area users and devices before full migration.
Lower MX and Autodiscover TTLs to 300 seconds 48–72 hours beforehand; pre-stage mailboxes and schedule cutover after hours; set up coexistence or forwarding, verify Autodiscover, Exchange Online connectors, and accepted domains; preconfigure SPF and DKIM, keep DMARC at p=none for testing, then enforce post-cutover; run test send/receive, monitor queues and NDRs, and keep a rollback plan using staged MX and backups; communicate timelines and new sign-in steps so Triangle staff know what to expect.
Discovery and readiness checks typically take 2–5 business days, pilots 5–10 business days, and production cutovers one to two evening or weekend windows; your role is granting admin and DNS access, sharing a list of critical apps and compliance needs, and selecting pilot users; under a managed services contract, your MSP right-sizes licenses, enforces security baselines, monitors 24/7, provides training and documentation, and delivers predictable per-user pricing with local on-site support in Raleigh and the greater Research Triangle.