Migrate

Moving mail off Microsoft 365

A tenant-wide application registration, and the thing everyone trips over: Graph and Exchange Online are separate resources.

Read this part first

What this connector cannot do. These are the facts that decide how long your weekend is.

Graph and Exchange Online are separate resources. The token that lists your users cannot open a mailbox. The connector asks for both; a registration with only one is the most common reason a migration will not start.
Calendar and contacts are not migrated, and MailDock does not serve them. Plan for them separately before you move.
Shared mailboxes come across; a Microsoft 365 Group’s own mailbox does not. The group becomes an alias to its members, and its shared history needs a job of its own. Discovery counts them so nobody finds it missing after cutover.
Mailbox-level forwarding set in the Exchange admin centre is invisible. Graph does not expose it. Only forwarding set up as an inbox rule is imported, and discovery says so every time.
An inbox rule must translate exactly, or it is refused: any rule with an exception, “message header includes”, “has an attachment”, a condition the importer does not recognise, “forward as attachment”, a folder that no longer exists, more than 20 conditions or 10 actions. Each refusal is named on import. Outlook’s “delete” becomes a move to Trash, because that is what it does.
Discovery stops at 5,000 users, groups or group members without saying so, and reads replies and rules for the first 200 mailboxes only, with a warning for the rest.

1
Register the application and get consent
The slow step, and an administrative one rather than a technical one.
2
Add the domain here first
Records published and verified, MX untouched.
3
Read the source, then import
Every mailbox, shared ones included, with its aliases, plus groups, automatic replies and inbox rules. Missing mailboxes are created with new passwords, shown once; the rest is imported, and a rule that cannot be carried across exactly is refused with a note.
4
Run the full copy
Microsoft’s delegation is tenant-wide — one token for every mailbox, unlike Google’s per-user model — and it is refreshed during the run.
5
Change the MX, then sync the delta
The delta is what makes it lossless.
6
Walk the checklist
Clients, new passwords, forwarding set in the Exchange admin centre, Microsoft 365 Group mailboxes, and the calendar decision.

An Entra ID application registration with Microsoft Graph application permissions (User.Read.All, Group.Read.All, and MailboxSettings.Read to import replies and rules) and Exchange Online’s IMAP.AccessAsApp.
Admin consent for the whole list, granted by a tenant administrator. Without it the failure looks like a bad password.
The application’s service principal registered in Exchange Online, and given FullAccess on each mailbox to be moved (Exchange Online PowerShell). Consent alone opens no mailbox.
The tenant id, application id and secret.
IMAP enabled for the mailboxes being moved. It is on by default.