Microsoft 365 Migration for Toronto Businesses: A Step-by-Step Guide

Microsoft documents several migration paths. The right one depends on the source, not on preference.

• Inventory every mailbox, shared mailbox, alias, distribution list and forwarding rule. Old forwarding rules are a common source of surprise mail loss and, sometimes, a sign of an old compromise.
• Map licences. Decide who needs Business Basic, Standard or Premium. Shared mailboxes generally do not need a licence; check the current size limits on your plan before moving very large mailboxes.
• Check mailbox sizes. One oversized mailbox can hold up a whole batch. In our Microsoft 365 clean-up project one staff mailbox held 82,456 items before an approved retention cutoff cut it by 62%.
• Decide what not to migrate: decade-old archives can go to a retained export instead.
• Turn on MFA for the new accounts from day one, using security defaults or Conditional Access, so the new tenant never starts insecure.

Microsoft lists the external DNS records it needs. The three every customer uses are MX, Autodiscover and SPF. Add the two DKIM CNAME records shown in the Defender portal so you can turn DKIM signing on right after cut-over.

1. 01

   48 hours or more before cut-over

   Lower the TTL on your MX and Autodiscover records to 300 seconds (5 minutes) so changes propagate quickly. Note the old values.

2. 02

   Cut-over evening

   Point MX at Microsoft 365, update Autodiscover to autodiscover.outlook.com, and replace your SPF record with one that includes spf.protection.outlook.com plus any other legitimate senders. Do not leave two SPF records.

3. 03

   Next morning

   Run a final incremental sync for mail that arrived at the old system during propagation.

4. 04

   Week after

   Enable DKIM, add or tighten DMARC, and raise TTLs back to normal. Our DMARC rollout guide covers the path from p=none to reject.

• Test mail in and out for an internal user, a shared mailbox and an external address on Gmail and Outlook.com.
• Outlook profiles: new profiles on each computer; old offline caches can cause duplicate folders.
• Phones: remove the old account and add the new one; check calendars sync.
• Shared mailboxes and permissions: Full Access and Send As re-applied.
• Scanners, copiers, websites and apps that send mail: update SMTP settings. Many will fail silently.
• Calendar resources and room bookings.
• Mail from your website contact form and accounting system still arrives.
• The old system stays read-only for at least 30 days, then is backed up and closed.

Missing mail usually means DNS has not propagated or someone's phone is still pointed at the old server. Duplicate messages are often old client-side Outlook rules, not the server; we traced one recurring duplicate-invoice problem to exactly that. Bounce-backs from your own domain after cut-over usually mean an SPF record that still lists only the old host.

Users who cannot sign in on Monday are nearly always an MFA registration they skipped. Book an hour of desk-side or remote help for Monday morning.

Microsoft 365 is not backed up the way most people assume; see cloud backup and recovery for Microsoft 365. Then work through the Microsoft 365 security settings while the tenant is still fresh, before old habits creep back.

Our Microsoft 365 migration service follows this runbook. If you are partway through and stuck, contact us.