This is the end-to-end guide for moving an on-premises Exchange Server (2013, 2016 or 2019 — or a hosted Exchange that exposes EWS) to Microsoft 365 with MigrateX. There is no hybrid to build and no PowerShell to install: MigrateX reads mailboxes and public folders over Exchange Web Services with one service account, and writes them into Exchange Online through Microsoft Graph. The server keeps serving mail until you cut the domain over.
1 · Plan the move
| Decision | Options | What it changes |
|---|---|---|
| Does the domain move? | Almost always yes — people keep @acme.com, now on Exchange Online | Cutover adds the domain to Microsoft 365 and points MX, Autodiscover, SPF and DKIM at Microsoft. |
| Who moves? | Everyone · active staff only | Disabled and resource mailboxes can stay behind; each moving person needs a Microsoft 365 license. |
| Waves or one weekend? | By department · all at once | How long both systems coexist. Waves use per-mailbox forwarding rules on the server; a weekend move skips them. |
| Public folders | Migrate as shared mailboxes · archive in place | Scope, and how many shared mailboxes appear in the target (each top-level folder becomes one). |
| What happens to the server? | Keep for a month · decommission | Keep it reachable until every wave has had its final delta pass and the report is signed off. |
Copy in waves, cut over once. Most moves fit in two to four weeks of copying and one evening of DNS.
2 · What becomes what
| Exchange Server | Microsoft 365 | How |
|---|---|---|
| Mailbox folders (nested) | Mailbox folders (nested) | Messages exported as MIME over EWS with read state, categories, flags and original dates; folders recreated by path |
| Calendar, recurring appointments | Calendar, recurrence pattern | Converted field by field including recurrence, reminders, free/busy |
| Contacts, contact sub-folders | Contacts, contact folders | Field by field |
| Online archive mailbox | Archive folder in the primary mailbox | Listed in the assessment; copied where the archive is reachable through EWS |
| Public folder (top level) | Shared mailbox pf-<name>@… | Created by MigrateX; Full Access granted from Shared & groups |
| Public folder (nested mail) | Folder in that shared mailbox | Same path under Inbox |
| Public folder (contacts / calendar) | Contact list / calendar in that shared mailbox | Named after the folder |
| Global Address List | User list for matching | Read with FindPeople; no Active Directory access needed |
| Domain | Domain | Added to Microsoft 365 and verified; MX/SPF/Autodiscover/DKIM switched at cutover |
Listed, not moved: shared and resource mailboxes on the server, distribution groups, server-side inbox rules, signatures stored in Outlook, mailbox permissions. See section 15.
3 · Prepare the Exchange server
- Make EWS reachable over HTTPSMigrateX connects to
https://mail.acme.com/EWS/Exchange.asmxfrom the internet. If Outlook Anywhere or ActiveSync already work from outside, EWS almost certainly does too. Test withhttps://mail.acme.com/EWS/Exchange.asmxin a browser — a sign-in prompt is the right answer. - Create a service accountA normal user with a mailbox (for example
svc-migratex), a long password, and no other roles. Basic or NTLM authentication — whichever the EWS virtual directory allows (Get-WebServicesVirtualDirectory | fl *Auth*). - Grant impersonationIn the Exchange Management Shell on the server:
New-ManagementRoleAssignment -Name "MigrateX impersonation" -Role ApplicationImpersonation -User svc-migratex. This lets one account read every mailbox without knowing any passwords. - Public folders: grant OwnerIf public folders are in scope, give the service account Owner on the tree:
Get-PublicFolder -Recurse | Add-PublicFolderClientPermission -User svc-migratex -AccessRights Owner. - Relax EWS throttling for the accountOptional but faster: a throttling policy with unlimited
EwsMaxConcurrency/EwsMaxBurstassigned to the service account. MigrateX backs off onErrorServerBusyeither way. - CertificateA publicly trusted certificate is best. A self-signed one works if you tick "Allow an untrusted certificate" when connecting — then only the credentials protect the link, so use it on a private network only.
4 · Prepare Microsoft 365
- Create the accounts with the same alias as the on-premises address so auto-match pairs them (
jane.doeon both sides). Directory sync is not required; if you already sync with Entra Connect, the accounts exist. - Assign licenses that include Exchange Online and wait for the mailboxes to be provisioned.
- A fallback domain (
.onmicrosoft.com) that accounts hold until cutover; the real domain is added at the end. - A Global Administrator to consent; the Exchange Administrator role for the MigrateX app so public folders can become shared mailboxes.
- In MigrateX: route Exchange Server → Microsoft 365; scope Mailboxes and, if wanted, Public folders. Licenses: one per person; public folders and delta passes are free.
5 · Connect
- Connect the Exchange sourceEWS URL, service account (
ACME\svc-migratexorsvc-migratex@acme.com), password, Basic or NTLM, and one mailbox to test impersonation against. Press Connect: MigrateX opens that mailbox's Inbox as the service account. The password is stored encrypted and used only for EWS calls. - Connect the Microsoft 365 targetAdmin consent as the Global Administrator. Detail: Connect a Microsoft 365 tenant.
You see: both tenant cards green on the overview. If the source says Exchange denies impersonation, the role assignment in step 3 has not taken effect yet — it can take a few minutes, or restart the MSExchangeServicesAppPool.
6 · Assess
The assessment reads the Global Address List and each mailbox's size, and lists public folders with item counts. It scores readiness and flags mailboxes over 50 GB, disabled accounts, and names that will not auto-match. Nothing is written anywhere.
7 · Match users
Auto-match pairs by alias; pair the rest by hand or import a CSV. Exclude leavers and service accounts you do not want to move. Detail: Matching users.
8 · Pilot
Migrate two or three people first — one with a large mailbox, one with a busy calendar. Check folder structure, recurring meetings and categories in Outlook on the web before you touch the rest.
9 · Mailboxes
Each mailbox is read folder by folder with SyncFolderItems, so a second pass copies only what changed. Read state, categories, flags and original dates are kept; the archive mailbox follows where it is exposed to EWS. Throttling from the server is honoured automatically.
10 · Public folders
- Read the treeOn the Public folders tab press Read public folders. Every folder is listed with its type (mail, contacts, calendar) and item count, and the shared mailbox it will land in.
- MigrateMigrate public folders creates one shared mailbox per top-level folder (
pf-sales@acme.onmicrosoft.com), recreates the folder path below its Inbox, and copies the items. Contact and calendar folders become a contact list or a calendar in that mailbox. - Grant accessGive the people who used the folder Full Access on the shared mailbox from the Shared & groups tab (or the Microsoft 365 admin center). It appears in their Outlook automatically.
- Run a delta pass before cutoverItems added since the first pass are copied; nothing is duplicated.
Folder types other than mail, contacts and calendar (notes, tasks, forms) are listed as Not supported and left on the server.
11 · Waves & delta
Move a department at a time. When a wave is verified, the cutover wizard sets a forwarding rule in each moved mailbox on the server so new mail lands in Microsoft 365 while the domain still points at the server. Run a delta pass on every wave the evening of the domain switch.
12 · Verify
Verification counts items per folder on both sides and lists any gap; Copy what is missing fills it. Detail: Verification and retries.
13 · Cutover
- Final delta passMailboxes and public folders.
- ForwardingAlready set per wave; the wizard checks every moved mailbox forwards to its Microsoft 365 address.
- Add and verify the domain in Microsoft 365Add the TXT record MigrateX shows and press Check.
- Claim the addressesPrimary addresses and aliases on
acme.comare applied to the Microsoft accounts and the shared mailboxes created from public folders. - Point DNS at MicrosoftMX to
acme-com.mail.protection.outlook.com, SPFinclude:spf.protection.outlook.com, Autodiscover CNAME toautodiscover.outlook.com, DKIM from the Defender portal. The wizard checks MX. Remove the old Autodiscover record — Outlook will otherwise keep finding the server. - Send the notice, sign offThe notice tells people to restart Outlook (a new profile is created automatically via Autodiscover) and to re-add the account on phones. Print the report.
14 · The day after
- Outlook desktop: if a profile does not repair itself, create a new one — Autodiscover now points at Microsoft 365.
- Phones: remove the old Exchange account and add the Microsoft 365 one in Outlook mobile.
- Recreate the server-side inbox rules and shared/resource mailboxes the report lists.
- Keep the server on for a few weeks with the forwarding rules in place; then remove the domain from the server and decommission.
15 · Limits
- Shared mailboxes, room and equipment mailboxes, and distribution groups on the server are listed, not created. Create them in Microsoft 365 from the Shared & groups tab or the admin center, then migrate their contents by matching them to a user-style mailbox.
- Server-side inbox rules, Outlook signatures, delegates and mailbox permissions are listed for you to recreate.
- Public folder types other than mail, contacts and calendar are left on the server.
- Exchange 2010 and older are not supported. Exchange 2013 must be at CU23 with EWS enabled.
- Items larger than 150 MB are rejected by Exchange Online and listed in the report.