Which steps you can undo
Sort every step into one of three kinds before the window. Reversible steps need a tested way back. Recoverable steps can be undone only with real effort and user impact. One-way steps get a named go/no-go decision, because the only protection is not taking them too early.
| Step | Kind | Recovery option |
|---|---|---|
| DNS and MX record changes | Reversible | Lower the TTL days ahead and keep the old values written down; switching back takes effect as caches expire. |
| Mailbox moves | Recoverable with effort | After a move the source mailbox becomes a mail user that routes to the target. Going back means planning a move in the other direction; prove it in the pilot before relying on it. |
| OneDrive moves | One-way | None built in: Microsoft calls the move one and done with no delta passes and leaves a redirect on the source. Freeze content changes and validate the pilot first. |
| Moving the email domain | One-way for the window | A domain belongs to one tenant at a time, so moving it back means removing it from the target and verifying it again in the source, with mail and sign-in impact. |
| Removing holds to migrate | Compliance decision | Holds block OneDrive moves; Microsoft’s path is remove, migrate, then reapply on the target. Get written legal sign-off and record the gap. |
| Deprovisioning the source tenant | One-way | Redirects to moved OneDrive files remain until the source tenant is deprovisioned. Do it only after the acceptance period ends. |
Before the window: clear the blockers
- Licenses. Buy or confirm Cross Tenant User Data Migration for every user who moves. Microsoft licenses it per user as a one-time fee on the source or target object, it covers mailbox and OneDrive moves, and migrations fail without it.
- Target mail users. Each moving mailbox needs a mail user in the target tenant with the source mailbox’s x500 addresses; moves fail for users that are not set up correctly.
- OneDrive in the target. Restrict OneDrive creation in the target tenant: if a user already has a OneDrive there, the move fails and cannot overwrite it.
- Source settings. Check for Service encryption with Customer Key on the source tenant and for read-only source OneDrives; both make moves fail.
- Holds. List every account under a hold policy and decide, with legal, how each one is handled.
- Size and paths. Flag OneDrives over 5 TB or 1 million items, and file paths that would exceed 400 characters on the target URL.
- Government clouds. Cross-tenant OneDrive migration is not supported for GCC, GCC High or DoD users; plan those separately.
- Pilot. Move a small group end to end, including one recovery drill for each recoverable step.
During the window: gate the one-way steps
Put a go/no-go checkpoint in front of each one-way step, with a named decision owner, the evidence they look at (pilot results, error counts, open blockers) and the message users receive either way. Run reversible steps first, so a no-go leaves you somewhere you can return from.
After the window: keep the way back open
Keep the source tenant until the business signs off the acceptance period: redirects to moved OneDrive files depend on it. Reapply holds on the target, record each exception, and only then schedule deprovisioning.
Download the Microsoft 365 cutover and rollback checklist (CSV). It lists every step with its kind, owner role, checkpoint, user communication and recovery option; it is a template and holds no client data. For the wider plan, see the tenant migration planning steps and how a tenant-to-tenant migration of Teams and SharePoint works.
Primary sources
- Cross-tenant mailbox migration — Microsoft Learn, accessed 2026-10-28
- Cross-tenant OneDrive migration overview — Microsoft Learn, accessed 2026-10-28
Frequently Asked Questions
Can a cross-tenant OneDrive migration be rolled back?
Not in the usual sense. Microsoft describes cross-tenant OneDrive moves as a one and done migration activity: the content is moved from source to target, a redirect is left on the source, and incremental or delta passes cannot be performed. Treat the move as one-way, freeze content changes first, and prove the process on a pilot group before the main window.
What license does a Microsoft 365 cross-tenant migration need?
The Cross Tenant User Data Migration add-on. Microsoft licenses it per migrated user as a one-time fee, assignable on the source or target user object, and the same license covers both mailbox and OneDrive moves. Microsoft states that migrations fail without it, so buy or confirm it before any other step.
What blocks a cross-tenant OneDrive move?
Microsoft lists several blockers: a hold policy on the account, Service encryption with Customer Key on the source tenant, an existing OneDrive for the user in the target tenant, a source OneDrive set to read-only, file paths longer than 400 characters in the target, and accounts over 5 TB or 1 million items. Clear each one before the window.
Does cross-tenant OneDrive migration work in GCC High?
No. Microsoft states that cross-tenant OneDrive migration is not supported for Government Cloud users, including GCC, GCC High and DoD, so government tenants need a different migration approach and a separate plan.
Talk to a senior architect
A one-hour call with a senior EPC Group architect covers your source and target tenants, the one-way steps in your plan and the gates in front of them. Email contact@epcgroup.net or call 888-381-9725.