Tenant-to-Tenant Migration Checklist

Print or save as PDF

How to use this checklist

• Print it or save it as a PDF from your browser, then work through it with both tenants' admins.
• Do not set a cutover date until the discovery and identity sections are complete.
• Treat each sign-off gate as a hard stop: if it is not signed, the next phase waits.
• For background on each step, read the full guide: Tenant-to-Tenant Migration Checklist: 12 Steps.

1. Discovery and assessment

• Users, groups, guests and licenses exported from the source tenant
• Mailbox sizes, archives and litigation or retention holds recorded
• SharePoint sites, OneDrive usage and sharing links inventoried
• Teams, private channels and their SharePoint sites listed
• Conditional Access policies, MFA methods and app registrations exported
• Power Automate flows, Power Apps and connectors listed
• Domains, DNS hosts, registrar access and certificate dependencies documented
• Plain-language risk list agreed: what moves, what waits, what will not migrate

2. Identity and domain strategy

• Decision recorded: keep existing UPNs or create new ones
• UPN and primary SMTP mapping sheet approved by IT and the HR naming owner
• Domain sequence written: which domains move, which stay, in what order
• DNS owner named for every domain
• Coexistence approach for free/busy and mail routing decided
• Plan for guests and external collaboration during waves agreed

3. Migration approach and tools

• Native Microsoft cross-tenant migration or third-party tool chosen per workload
• Cross-Tenant User Data Migration licenses sized, if native mailbox or OneDrive moves are used
• Tools scored on workload coverage, throttling behavior, reporting and support
• Teams chat and other unsupported items listed and signed off with stakeholders

4. Wave and communications plan

• Pilot group chosen (representative users, not only IT)
• Early adopter, departmental and final long-tail waves defined, including service accounts
• Rollback criteria written for each wave
• Support channel and approver for emergency schedule changes named
• Communication templates ready for each wave
• Blackout dates (payroll, quarter-end, client deadlines) on the plan

5. Target tenant readiness

• MFA, Conditional Access and break-glass accounts in place and tested
• License pools sized for each wave
• SharePoint, OneDrive and Teams policies aligned where required
• Naming standards, retention labels and DLP approved by leadership

6. Pilot

• Mailbox folders, calendar and contacts checked
• OneDrive and key SharePoint libraries opened and edited
• Teams membership and critical channels confirmed
• Mobile clients, SSO apps and MFA registration tested
• Printers, scanners and line-of-business mail tested, if in scope
• Every defect and fix written into the runbook before wave two

7. Workload sequence

• Identity ready in the target tenant
• Exchange mailboxes moved
• OneDrive and SharePoint content moved
• Teams membership and supported content moved
• Power Platform resources rebuilt and connections re-pointed
• Delta sync scheduled so final cutover is short, not a full recopy

8. Coexistence during waves

• Mail routing works for users still in the source tenant
• Calendar free/busy works where supported
• Guest and external collaboration pattern working for the project
• Users told which tenant to sign into each week

9. Final cutover and business validation

• Final delta sync and planned hold removals done
• Domain removed from source and verified in target per runbook
• MX, Autodiscover, SPF, DKIM and DMARC updated
• Residual source access revoked for completed waves
• Business tests passed: finance mail, shared mailboxes, executive calendars, line-of-business mail

10. Decommission the source tenant

• Retention or legal exports taken, if required
• Domains removed cleanly
• Unused subscriptions cancelled or repurposed
• Decommission evidence documented for audit

11. Optimize and train

• Permissions and sharing links reviewed
• Licenses reclaimed and groups cleaned up
• Short role-based training delivered for Teams and SharePoint
• Support ticket watch staffed for 30 to 60 days

12. Retrospective

• What surprised the pilot recorded
• Tool throttling and failures recorded
• Communications that reduced help-desk load noted
• Playbook updated for the next acquisition

Sign-off gates

• Identity map approved by IT and HR naming owner
• Domain sequence written with DNS owners named
• Security parity in the target before mass waves
• Pilot sign-off with defects closed or waived in writing
• Wave communication templates ready
• App and SSO inventory retested after the first production wave
• Post-cutover support staffing scheduled
• Source decommission criteria defined

Common questions