The Complete Microsoft 365 Migration Checklist for

Microsoft 365 Migration Checklist: The 2026 Enterprise Playbook

Microsoft 365 migration in 2026 is well-understood — but the gap between a smooth migration and a painful one is whether you executed the right pre-migration checklist. EPC Group has migrated more than 200 organizations to Microsoft 365 since the original Office 365 program. The patterns that distinguish successful migrations are consistent.

This checklist walks through every pre-migration, migration, and post-migration step we deliver for Fortune 500 healthcare, financial services, government, and defense organizations.

TL;DR — The 7-Phase Migration Checklist

Phase	Duration	Focus
1: Discovery	3-4 weeks	Inventory, identity, network, current-state audit
2: Architecture	2-4 weeks	Tenant design, governance, security baseline
3: Pilot	3-4 weeks	50-100 user pilot, validation, retrospective
4: Wave Migrations	8-16 weeks	Departmental waves, training, support
5: Cutover	2-4 weeks	DNS, Mail flow, final delta, decommission
6: Stabilization	4-8 weeks	Issue resolution, governance enforcement
7: Optimization	Ongoing	Cost optimization, Copilot deployment, governance maturity

Phase 1: Discovery Checklist

Identity Discovery

• Microsoft Entra ID readiness (or Azure AD Connect for on-premises AD)
• User count and licensing baseline
• MFA status and Conditional Access readiness
• Service account inventory
• Privileged access review (Global Admins, Exchange Admins, SharePoint Admins)
• External identity providers (B2B guests, B2C, federated auth)
• Single Sign-On (SSO) connections to SaaS apps
• User provisioning automation (HR feed integration)

Email Discovery (Exchange)

• Mailbox inventory (count, size, growth trend)
• Public folder usage (will likely require migration to Microsoft 365 Groups)
• Shared mailboxes
• Distribution lists vs Microsoft 365 Groups
• Mail flow rules and transport rules
• Connectors and third-party email security gateways
• DLP policies and email retention
• Calendar resources (rooms, equipment)
• Mobile device usage and ActiveSync policies

File Storage Discovery (SharePoint, OneDrive, File Servers)

• SharePoint site collection inventory
• OneDrive usage and per-user storage
• File server volumes and total data size
• Permissions complexity audit
• External sharing configuration
• Custom solutions (SharePoint Designer workflows, SPFx, full-trust)
• Third-party tools (ShareGate, AvePoint, Metalogix)
• Backup and DR configuration

Collaboration Discovery (Teams)

• Skype for Business usage (if migrating from)
• Microsoft Teams usage if already deployed
• Meeting room equipment and Teams Rooms readiness
• PSTN calling requirements
• Compliance recording for regulated communications
• Third-party telephony providers

Network Discovery

• Internet bandwidth per office
• Microsoft 365 endpoint allowlisting
• Proxy server configuration
• ExpressRoute for Microsoft 365 (if applicable)
• DNS configuration
• Latency tests to nearest Microsoft datacenter
• VPN load and remote work patterns

Security and Compliance Discovery

• Current security posture (third-party EDR, DLP, SIEM)
• Compliance requirements (HIPAA, FINRA, FedRAMP, CMMC, SOC 2, GDPR, CCPA)
• Sensitivity classification standards
• eDiscovery and legal hold requirements
• Audit log retention requirements
• Data residency requirements
• Privacy regulations (GDPR, CCPA, HIPAA)

License Strategy

• Current Microsoft licensing (Volume Licensing, EA, CSP, MOSP)
• Software Assurance entitlements
• License needs analysis (E3 vs E5, Frontline F1/F3, EMS, Defender add-ons)
• Microsoft 365 Copilot license planning
• Microsoft Fabric capacity planning (if applicable)

Phase 2: Architecture Checklist

Tenant Design

• Tenant type (Commercial, GCC, GCC High, DoD)
• Custom domain registration
• Email domain strategy (cutover, hybrid, staged)
• Microsoft Entra ID tenant settings
• Cross-tenant access settings
• Microsoft 365 admin role design

Security Baseline

• Conditional Access policy design
• MFA enforcement plan
• Defender for Office 365 Plan 2 configuration
• Defender for Endpoint Plan 2 deployment plan
• Defender for Cloud Apps configuration
• Microsoft Sentinel deployment plan
• Microsoft Purview Information Protection design

Information Architecture

• SharePoint hub-spoke design
• OneDrive vs SharePoint vs Teams content placement strategy
• Sensitivity label taxonomy
• Retention policy design
• External sharing policy

Governance Framework

• Naming conventions
• Site provisioning automation
• Group lifecycle management
• Site ownership and inactive site cleanup
• Microsoft 365 Groups expiration policy

Phase 3: Pilot Checklist

Pilot User Selection (50-100 users)

• Cross-departmental representation
• Mix of executive, knowledge worker, operational roles
• Tech-savvy and non-tech-savvy personas
• At least 3 geographic locations
• 1-2 regulated-data handlers (with extra governance)

Pilot Migration

• Mailbox migration to Exchange Online
• OneDrive content migration
• Pilot SharePoint site collection migration
• Microsoft Teams pilot
• Conditional Access policies in audit mode
• Defender protection enabled
• Pilot user training

Pilot Validation

• Mailbox content fidelity check
• Calendar / room booking validation
• OneDrive sync validation
• SharePoint permission validation
• Teams chat history preservation
• Mobile device functionality
• User satisfaction survey
• Help desk ticket volume baseline

Phase 4: Wave Migration Checklist

Per-Wave Preparation

• User communication (4 weeks, 2 weeks, 1 week, day-of)
• Training scheduled (live + recorded)
• Help desk staffing increase for wave week
• Self-service migration runbook (where applicable)

Per-Wave Execution

• Mailbox migration via Exchange Online migration tool
• OneDrive migration via M365 Migration Manager or ShareGate
• SharePoint site migration in priority order
• Teams migration
• License assignment
• Conditional Access policy escalation (audit → enforce)
• User device re-enrollment to Intune

Per-Wave Validation

• Mailbox content fidelity check
• OneDrive sync validation per user
• SharePoint permission spot-check
• Teams chat history validation
• User-reported issue triage

Phase 5: Cutover Checklist

• DNS cutover (MX records to Exchange Online)
• Mail flow validation
• Final delta migrations (mailbox, OneDrive, SharePoint)
• On-premises systems set to read-only
• User device cleanup (disable old VPN, remove old Outlook profiles)
• Service account decommissioning
• License reduction on legacy systems
• DR plan update for Microsoft 365

Phase 6: Stabilization Checklist

• Help desk ticket trending review (target: declining trend over 4-8 weeks)
• Audit (Premium) configuration verification
• Microsoft Sentinel ingestion validation
• Conditional Access policy enforcement audit
• Sensitivity-label coverage report
• User adoption metrics (Office app usage, Teams DAU, SharePoint MAU)

Phase 7: Optimization Checklist

• License audit (downgrade unused licenses)
• Storage cleanup (orphaned OneDrive accounts, abandoned SharePoint sites)
• Microsoft 365 Copilot Readiness Assessment
• Microsoft Fabric / Power BI deployment planning
• Microsoft 365 Apps for Enterprise update channel review
• Quarterly governance review

Frequently Asked Questions

How long does a Microsoft 365 migration take?

EPC Group standard migration timeline: 18-26 weeks for 5,000-user enterprise. Discovery 3-4 weeks, architecture 2-4 weeks, pilot 3-4 weeks, wave migrations 8-12 weeks, cutover 2-4 weeks. Smaller migrations (under 1,000 users) typically run 10-14 weeks. Fortune 500 migrations (10,000+ users) extend to 26-40 weeks with phased rollout.

What's the typical cost of a Microsoft 365 migration?

EPC Group fixed-fee Microsoft 365 migration accelerators are sized for 1,000-5,000 user organizations; Fortune 500 migrations (10,000+ users) are scoped fixed-fee. License costs are separate (Microsoft list price: M365 E3 $36/user, E5 $57/user).

Should I do a cutover, hybrid, or staged migration?

Cutover migration (under 150 mailboxes, single weekend cutover) is appropriate for very small organizations. Staged migration (mailbox-by-mailbox over weeks) for SMB. Hybrid migration (Exchange Online and on-premises Exchange coexist) is the standard for organizations over 150 users — provides flexibility, parallel-run period, and rollback capability.

What are the most common Microsoft 365 migration mistakes?

Three patterns: (1) skipping pre-migration cleanup — migrating duplicate, abandoned, or non-compliant content adds cost and noise; (2) underestimating training — users without role-based training revert to old habits; (3) deploying without governance — sites, groups, and content sprawl uncontrolled within months without naming conventions, lifecycle policies, and ownership.

How do I migrate SharePoint Designer workflows?

SharePoint Designer 2013 workflows are deprecated in SharePoint Online. Migration paths: 80-95% convert to Power Automate via the built-in migration assistant; remaining 5-20% require manual rebuild. For complex workflows with custom code, evaluate Power Apps custom solutions.

Can I migrate during business hours?

Most Microsoft 365 migration tooling supports incremental delta migrations. Source systems remain read-write during initial migration with overnight delta migrations until final cutover. Final cutover is typically scheduled for a weekend window.

What's the difference between cutover and hybrid Exchange migration?

Cutover: all mailboxes migrate in single weekend, on-premises Exchange decommissioned. Hybrid: Exchange Online and on-premises Exchange coexist for weeks/months, mailboxes migrate gradually. Hybrid is the standard for enterprise migrations because it provides parallel-run safety, rollback capability, and gradual user transition.

Do I need ShareGate or AvePoint for migration?

For straightforward file server or Google Drive migrations, Microsoft 365 Migration Manager (free, native) is often sufficient. For complex SharePoint hub-spoke architectures, M&A tenant-to-tenant consolidations, or regulated-industry compliance reporting, ShareGate ($5-50K/project) or AvePoint ($50-500K depending on scope) deliver better outcomes.

How EPC Group Delivers Microsoft 365 Migrations

EPC Group has been delivering Microsoft 365 migrations since the original Office 365 program. Errin O'Connor's Microsoft Press books Microsoft Azure: Plain & Simple and Microsoft SharePoint 2013 Plain & Simple are referenced in Microsoft Learn-recommended reading lists.

Every Microsoft 365 migration we deliver includes the 7-phase checklist above, Microsoft Purview information protection planning, Microsoft 365 Copilot readiness assessment, modern hub-spoke SharePoint information architecture, Power Platform extension scope, and post-go-live managed services with monthly governance reviews.

For regulated industries, every engagement includes BAA verification (HIPAA), HIPAA / SOC 2 / FedRAMP / FINRA / CMMC-specific control mapping, audit-defensible documentation, and incident response runbook scoped to industry-specific breach notification requirements.

Next Steps

Schedule a 30-minute discovery call at /schedule or call (888) 381-9725. Senior architects (not sales reps) take discovery calls. We'll discuss your current Microsoft footprint, evaluate migration approach, and outline next steps.

Related reading: SharePoint Online Migration Guide 2026, HIPAA-Compliant Microsoft 365, and Microsoft 365 Security Best Practices.