Migrate mailboxes to Exchange Online with a staged migration

Be sure to prepare for a staged Exchange migration, especially verifying the ability to successfully connect to your on-premises Exchange organization.

• Install and configure the Microsoft Online Services Directory Synchronization tool.   The Directory Synchronization tool must be running to perform a staged migration. The tool creates the mail-enabled users in your Exchange Online organization that are converted to mailboxes during the migration. For more information about how to install and activate the Directory Synchronization tool, see Active Directory synchronization: Roadmap.

• Plan for user identity management.   After on-premises mailboxes are migrated to Exchange Online, the synchronization process continues to update the user attributes for the Exchange Online mailboxes according to changes made in Active Directory on-premises. This means that the source of authority for managing user identity is your on-premises directory. However, after migrating all on-premises mailboxes to Exchange Online, you can configure directory synchronization so that the source of authority is the Office 365 directory service, which allows you to manage mailbox properties in Exchange Online. For more information about user identity management after migrating mailboxes to Exchange Online, see the following topics:

  • User identity management in a staged Exchange migration

  • Directory synchronization and source of authority

  • Manage directory synchronization

• Add your on-premises Exchange organization as an accepted domain of your Office 365 organization.   The migration service uses the SMTP address of your on-premises mailboxes to create the email address for the new Exchange Online mailboxes. To run a staged migration, the on-premises domain has to be an accepted domain of your Office 365 organization. For more information, see Add your domain to Office 365.

• Configure Outlook Anywhere on your on-premises Exchange server.   The email migration service uses RPC over HTTP, or Outlook Anywhere, to connect to your on-premises Exchange server. For information about how to set up Outlook Anywhere for Exchange 2007 and Exchange 2003, see the following:

  • Exchange 2007: How to Enable Outlook Anywhere

  • Exchange 2003: Deployment Scenarios for RPC over HTTP

  • How to Configure Outlook Anywhere with Exchange 2003

  Important:
  Your Outlook Anywhere configuration must be configured with a certificate issued by a trusted certification authority (CA). It can't be configured with a self-signed certificate. For more information, see How to Configure SSL for Outlook Anywhere.

• Verify that you can connect to your on-premises Exchange organization using Outlook Anywhere.   Try one of these methods to test your connection settings:

  • Use Microsoft Outlook from outside your corporate network to connect to your on-premises Exchange mailbox.

  • Use the Microsoft Exchange Remote Connectivity Analyzer to test your connection settings. Use the Outlook Anywhere (RPC over HTTP) or Outlook Autodiscover tests.

  • Run the following Shell commands.

    Copy

    $Credentials = Get-Credential
    

    Copy

    Test-MigrationServerAvailability -ExchangeOutlookAnywhere -Autodiscover -EmailAddress <email address for on-premises administrator> -Credentials $credentials
    

  • Successfully create a migration endpoint to the Exchange organization that hosts the mailboxes that you're migrating. When you create the endpoint, select Outlook Anywhere as the endpoint type. For more information, see Create migration endpoints.

• Assign an on-premises user account the necessary permissions to access and modify mailboxes in your Exchange organization.   The on-premises user account that you use to connect to your on-premises Exchange organization (also called the migration administrator) must have the necessary permissions to access and modify the on-premises mailboxes that you want to migrate to Exchange Online. This user account is used to create a migration endpoint to your on-premises organization.

  The following list shows the administrative privileges required to migrate mailboxes using a staged migration. There are three possible options.

  • The migration administrator must be a member of the Domain Admins group in Active Directory in the on-premises organization.

    Or

  • The migration administrator must be assigned the FullAccess permission for each on-premises mailbox AND the WriteProperty permission to modify the TargetAddress property on the on-premises user account.

    Or

  • The migration administrator must be assigned the Receive As permission on the on-premises mailbox database that stores the user mailboxes AND the WriteProperty permission to modify the TargetAddress property on the on-premises user account.

  For more information, see the following.

   

  Exchange 2007	Use the Add-MailboxPermission cmdlet to add permissions to a mailbox How to allow mailbox access
  Exchange 2003	Microsoft Knowledge Base article 268754 - How to assign users or groups full access to other user mailboxes Microsoft Knowledge Base article 821897 - How to assign service account access to all mailboxes in Exchange Server 2003

• Prepare the CSV file.   Identify the group of users whose on-premises mailboxes you want to migrate to Exchange Online. Include these users in a CSV file that will be used to create a migration batch. For information about preparing the CSV file, see Step 2: Create a CSV file to use for a staged migration.

• Disable Unified Messaging.   If the on-premises mailboxes you're migrating are enabled for Unified Messaging (UM), you have to disable UM on the mailboxes before you migrate them. You can then enable UM on the mailboxes after the migration is complete.

Return to top

Identify the group of users whose on-premises mailboxes you want to migrate to Exchange Online. Include these users in a CSV file that will be used to create a migration batch. Each row in the CSV file contains information about an on-premises mailbox. This information is used by Exchange Online to process the migration.

Important:
There isn't a limit for the number of mailboxes that you can migrate to the cloud using a staged Exchange migration. However, the CSV file for a migration batch can contain a maximum of 2,000 rows. To migrate more than 2,000 mailboxes, you have to create additional CSV files, and then use each one to create a new migration batch.

Supported attributes

The CSV file for a staged migration supports the following three attributes. Each row, which corresponds to a mailbox, must contain a value for each attribute included in the CSV file.

• EmailAddress specifies the primary SMTP email address for users’ on-premises mailboxes. Email addresses must use a valid SMTP format, for example, pilarp@tailspintoys.com. This attribute is required.

  Important:
  Be sure to use the primary SMTP address for on-premises mailboxes and not user IDs from the cloud-based organization. For example, if the on-premises domain is named tailspintoys.com but the cloud-based email organization is named service.tailspintoys.com you would use the tailspintoys.com domain name for email addresses in the CSV file.

• Password is the password that will be set on the new Exchange Online mailbox. Any password restrictions that are applied to your cloud-based organization apply to the passwords included in the CSV file. A password has to have a minimum length of eight characters. This attribute is optional.

• ForceChangePassword specifies whether a user must change the password the first time they sign in to their new cloud-based mailbox. Use either True or False for the value of this parameter. Other values are invalid. This attribute is optional.

  Note:
  If you’ve implemented a single sign-on solution by deploying Active Directory Federation Services 2.0 (AD FS 2.0) in your on-premises organization, you must use False for the value of the ForceChangePassword attribute.

CSV file format

Here's an example of the format for the CSV file. In this example, three on-premises mailboxes are migrated to Exchange Online.

EmailAddress,Password,ForceChangePassword
pilarp@tailspintoys.com,Pa$$w0rd,False
tobyn@tailspintoys.com,Pa$$w0rd,False
briant@tailspintoys.com,Pa$$w0rd,False

The first row, or header row, of the CSV file lists the names of the attributes, or fields, specified in the rows that follow. Each attribute name is separated by a comma.

Each row under the header row represents one user and supplies the information that will be used to migrate the user's mailbox. The attribute values in each row must be in the same order as the attribute names in the header row. Each attribute value is separated by a comma.

Use any text editor, or an application like Microsoft Excel, to create the CSV file. Save the file as a .csv or .txt file.

Tip:
If the CSV file contains non-ASCII or special characters, save the CSV file with UTF-8 or other Unicode encoding. Depending on the application, saving the CSV file with UTF-8 or other Unicode encoding may be easier when the system locale of the computer matches the language used in the CSV file.

Return to top

For a staged migration batch, you have to create an Exchange Outlook Anywhere migration endpoint. A migration endpoint is a management object in Exchange Online that contains the connection settings for the on-premises server that hosts the mailboxes you're migrating and the credentials for an on-premises user account that has the necessary administrative permissions to migrate mailboxes. When you create a migration batch, the information in the migration endpoint is used to connect to the on-premises Exchange server. The migration endpoint also defines the number of mailboxes to migrate simultaneously.

For more information about creating an Exchange Outlook Anywhere migration endpoint, see Create migration endpoints.

Tip:

Although you can create the first Exchange Outlook Anywhere migration endpoint when you create the first migration batch for a staged migration, we recommend that you create migration endpoints before you create a migration batch. When you create a migration endpoint, Exchange Online tests the connection to the on-premises Exchange server. The migration endpoint isn't created unless Exchange Online can successfully connect to the on-premises server. This lets you troubleshoot and resolve connectivity issues before you create a migration batch. Otherwise, you have to cancel the migration batch and resolve any connectivity issues before you can create a migration batch.

Return to top

To create a migration batch, you have to submit a CSV file that contains the information about the mailboxes you want to migrate. You can create and start a maximum of 100 migration batches at a time.

$Credentials = Get-Credential

$MigrationEndpoint = New-MigrationEndpoint -ExchangeOutlookAnywhere -Name EXCH-01Endpoint -Autodiscover -EmailAddress administrator@contoso.com -Credentials $Credentials

New-MigrationBatch -Name StagedBatch1 -SourceEndpoint $MigrationEndpoint.Identity -CSVData ([System.IO.File]::ReadAllBytes("C:\Users\Administrator\Desktop\StagedBatch1.csv")) -AutoStart

New-MigrationBatch -Name StagedBatch2 -SourceEndpoint EXCH-01Endpoint -CSVData ([System.IO.File]::ReadAllBytes("C:\Users\Administrator\Desktop\StagedBatch2.csv"))

If you create a migration batch and configure it to be manually started, you can start it by using the EAC or the Shell. If a migration batch is currently running when you start another migration batch, the status for the newly started batch is set to Created. As previously stated, when the migration batch is completed, Exchange Online sends an email message to the administrator. This message lists the number of mailboxes that were successfully migrated and how many mailboxes couldn’t be migrated. The message also includes links to migration statistics and error reports that contain more detailed information.

Important:
Migration batches with a status of Synced that have no administrator-initiated activity (for example, no administrator has stopped and restarted a migration batch or edited a migration batch) for the last 90 days will be stopped, and then deleted 30 days later if no further action is taken by the administrator.

Start-MigrationBatch -Identity <identity>

After a migration batch has finished running and you’ve verified that all mailboxes in the batch are successfully migrated and the initial synchronization of mailbox items to Exchange Online is complete, it’s recommended that you convert the on-premises mailboxes in the migration batch to mail-enabled users. Why? After a staged Exchange migration, a user has an on-premises mailbox and an Exchange Online mailbox. Because mail sent to the user’s on-premises mailbox is forwarded to their Exchange Online mailbox after migration, users need to connect to their Exchange Online mailboxes to access their email. But if a person uses Outlook to open their mailbox, the Autodiscover service still tries to connect to the on-premises mailbox. After you convert on-premises mailboxes to mail-enabled users, the Autodiscover service uses a mail-enabled user to connect Outlook to the Exchange Online mailbox after the user creates a new Outlook profile.

Another important reason to convert on-premises mailboxes to mail-enabled users is to retain proxy addresses from the Exchange Online mailboxes by copying proxy addresses to the mail-enabled users. This lets you manage cloud-based users from your on-premises organization by using Active Directory. Also, if you decide to decommission your on-premises Exchange organization after all mailboxes are migrated to Exchange Online, the proxy addresses you’ve copied to the mail-enabled users will remain in your on-premises Active Directory.

For more information and to download scripts that you can run to convert mailboxes to mail-enabled users, see the following:

• Convert Exchange 2007 mailboxes to mail-enabled users

• Convert Exchange 2003 mailboxes to mail-enabled users

Return to top

After all mailboxes in a migration batch have been successfully migrated and you’ve converted the on-premises mailboxes in the batch to mail-enabled users, you're ready to delete a staged migration batch. Be sure to verify that mail is being forwarded to the Exchange Online mailboxes in the migration batch. When you delete a staged migration batch, the migration service cleans up any records related to the migration batch and deletes the migration batch. The batch is removed from the list of migration batches on the migration dashboard.

Note:
You can perform this step and the previous step of converting the on-premises mailboxes to mail-enabled users in any order.

Remove-MigrationBatch -Identity <identity>

• Assign licenses to Office 365 users.   When you migrate a user's mailbox to Exchange Online using a staged migration, an Office 365 user account is created for the user. You have to activate this user account by assigning a license. If you don't assign a license, the mailbox will be disabled when the grace period ends. To assign a license in the Office 365 admin center, see Assign or remove a license.

• Create an Autodiscover DNS record.   If you’ve migrated all on-premises mailboxes to Exchange Online and are planning to completely transition your on-premises organization to Office 365, you can configure an Autodiscover DNS record for your Office 365 organization to enable users to connect to their new Exchange Online mailboxes with Microsoft Outlook and mobile clients. This new Autodiscover DNS record has to use the same namespace that you’re using for your Office 365 organization. For example, if your cloud-based namespace is contoso.onmicrosoft.com, the Autodiscover DNS record you need to create is autodiscover.contoso.onmicrosoft.com.

  Exchange Online uses a CNAME record to implement the Autodiscover service for Outlook and mobile clients. The Autodiscover CNAME record must contain the following information:

  • Alias   autodiscover

  • Target   autodiscover.outlook.com

  For more information, see Create DNS records for Office 365.

• Configure your MX record to point to your Office 365 organization.   Until you change your MX record, email sent to users is still routed to their on-premises Exchange mailboxes and then forwarded to the corresponding Exchange Online mailbox. This lets users use their Exchange Online mailbox to access email sent to their on-premises mailbox. When you configure your organization's MX record to point to your Office 365 email organization, all email is sent directly to the Exchange Online mailboxes. For information about configuring MX records, see Create DNS records for Office 365.

  Important:
  It can take from 24 to 72 hours for the updated MX record to be propagated. Wait at least 24 hours after you change the MX record and then verify that mail is being routed directly to Exchange Online mailboxes.

• Decommission on-premises Exchange servers.   After you’ve verified that all email is being routed directly to the Exchange Online mailboxes, have completed the migration of all mailboxes, and no longer need to maintain your on-premises email organization or don’t plan on implementing a single sign-on solution, you can uninstall Exchange and the Azure Active Directory Sync tool from your servers and remove your on-premises Exchange organization.

  Important:

  If you implement a single sign-on solution, we strongly recommend that you maintain at least one Exchange server so that you can access Exchange System Manager (Exchange 2003) or the Exchange Management Console/Exchange Management Shell (Exchange 2007, Exchange 2010, and Exchange 2013) to manage mail-related attributes on the on-premises mail-enabled users. For Exchange 2007 and Exchange 2010, the Exchange server that you maintain should have the Hub Transport, Client Access, and Mailbox server roles installed. For Exchange 2013, you should maintain the Mailbox and Client Access servers.

  For more information, see the following:

  • Modify or Remove Exchange 2010

  • How to Remove an Exchange 2007 Organization

  • How to Uninstall Exchange Server 2003

  Caution:
  Decommissioning Exchange can have unintended consequences. Before decommissioning your on-premises Exchange organization, we recommend that you contact Microsoft Support.

Return to top

Here are some tips to optimize your staged Exchange migration:

• Change the DNS Time-to-Live (TTL) setting on your MX record.   Before you start to migrate mailboxes, change the DNS TTL setting on your current MX record to a shorter interval, such as 3,600 seconds (one hour). Then, when you change your MX record to point to your Office 365 email organization after all mailboxes are migrated, the updated MX record should propagate more quickly because of the shortened TTL interval.

• Communicate with your users   Let users know ahead of time that you’re migrating their on-premises mailbox to Exchange Online. Consider the following:

  • Ask users to delete old or unnecessary email messages from their Exchange mailbox before migration. This helps reduce the amount of data that has to be migrated and can help reduce the overall migration time. Or, you can clean up their mailboxes yourself.

  • Suggest that users back up their Inbox.

• Before you start a staged migration batch, tell users they need to switch over to their Exchange Online mailboxes to send and receive email.   Inform users before you start the batch, because they'll stop receiving email sent to their on-premises mailboxes soon after the TargetAddress property is configured to forward mail to their Exchange Online mailbox. Users can sign in to their Exchange Online mailbox as soon as their mail-enabled user object is converted to a mailbox. Also, the Sent Items folder on their on-premises mailbox won't be copied to their Exchange Online mailbox after initial synchronization is complete. So users should start using their Exchange Online mailbox soon after the migration batch is started.

  Be sure to give them the password to their new mailbox (if applicable) and send them links to the following topics to help them connect to their Exchange Online mailbox:

  • Connect Outlook to this account

  • Sign in to Outlook Web App

• Require users to change their password.   In the CSV file, set the ForceChangePassword attribute to True. This forces users to change the password the first time they sign in to their new Exchange Online mailbox and helps ensure that only the user knows the password. Be sure to encourage people to use strong passwords. However, as previously explained, if you’ve implemented a single sign-on solution by deploying AD FS 2.0 in your on-premises organization, you must use False for the value of the ForceChangePassword attribute.

Return to top