{"id":10941,"date":"2019-11-04T13:57:57","date_gmt":"2019-11-04T21:57:57","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10941"},"modified":"2023-06-15T15:52:10","modified_gmt":"2023-06-15T22:52:10","slug":"microsoft-migrates-150-000-mailboxes-to-exchange-online","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/microsoft-migrates-150-000-mailboxes-to-exchange-online\/","title":{"rendered":"How Microsoft migrated 99.9% of internal mailboxes to Exchange Online"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Microsoft migrated hundreds of thousands of internal, on-premises Exchange servers to Exchange Online and Office 365 to deliver a secure, robust email experience built for a modern, mobile workforce. This staged migration required transparent communication, proactive coordination with stakeholders, and meticulous planning. Learn the steps Microsoft Digital took, the challenges we faced, and best practices for a smooth, seamless transition to a cloud-first, mobile-ready mailbox platform.<\/p>\n
Microsoft Digital manages one of the largest enterprise infrastructures in the world. Microsoft Digital planned and executed the staged migration of more than 150,000 mailboxes from Exchange on-premises servers to Office 365 and Exchange Online in 2015\u2014a multistep process that spanned several months.<\/p>\n
By planning ahead and then applying lessons learned during early deployments, we accomplished our goal of moving nearly all user mailboxes and decommissioning the vast majority of on-premises Exchange servers. This paper describes the steps we took, the challenges we faced, and the lessons we learned that IT pros can benefit from as they prepare for their own migration.<\/p>\n
This paper is based on the experience of Microsoft Digital. It\u2019s not intended to serve as a general procedural guide. Because each enterprise environment is unique, each organization should adapt the plans and best practices presented here to meet its specific needs.<\/p>\n
Note that this paper is an edited version of the original and has been updated for length and to reflect product and organizational name changes.<\/p>\n
Before releasing Office 365 to the public, Microsoft recognized the advantage\u2014to both users and the company\u2014of migrating to Exchange Online. Those benefits include:<\/p>\n
As IT managers, we also benefited from:<\/p>\n
We took care to prioritize the migration methodically and thoughtfully. We determined which internal business applications would be affected by mailbox migration and decided how to test them. We also developed tools that both Microsoft Digital and users could use to fix problems that arose.<\/p>\n
But before any implementation could begin, we needed to tell everyone at Microsoft about changes coming to their email, coordinate with stakeholders, and prepare support teams. We confirmed the migration process, so we knew it would work, and we identified business-critical internal applications to make sure they would run.<\/p>\n
Once everything was in place, we decided who would migrate first\u2014and then we set the date.<\/p>\n
Timely and thorough communication was a priority. We identified stakeholders and asked for their approval. We prepared support materials and trained Helpdesk staff to support the new service.<\/p>\n
We also created an array of informative communications and self-service materials for users. Throughout the migration, employees could find information about the service they were migrating to on:<\/p>\n
We communicated with people whose mailboxes were being migrated in two ways. First, we published information to CSEWeb. Then, we sent email. We also shared information with the IT managers at each office site.<\/p>\n
We wanted to make sure that users could get the Exchange service reference materials they needed after migration, so we published this information in SharePoint. We used standard templates to display service information, a setup page, troubleshooting tips, known issues, and support and other information.<\/p>\n
Both the troubleshooting and known-issues sections saved support teams and Microsoft Digital time by reducing the number of user-assistance requests.<\/p>\n
Our communication plan included a series of emails to inform people about the upcoming migration. After trialing different timing for our emails and revieFwing user satisfaction scores, we set up a schedule for user notification. The initial,\u00a0All-in<\/i>\u00a0email went out two weeks before migration, a\u00a0Scheduled<\/i>\u00a0email was sent two days before migration, and a\u00a0Welcome<\/i>\u00a0email was sent immediately upon successful migration. Although some people complained that this schedule didn\u2019t give them enough warning, most agreed that it left enough time to prepare for the migration.<\/p>\n
We also set up contingency email templates to use if a migration would be delayed or if there were problems during migration.<\/p>\n
The\u00a0All-in<\/i>\u00a0email notifying people of the migration to Exchange Online came from a high-level executive. We decided on a top-down approach so that users would be more at ease with their executive leadership team paving the way forward. It notified people that their email would soon be moving and that they would receive a follow-up email with more information.<\/p>\nPreparation: Scheduled email<\/h4>\n
We sent the\u00a0Scheduled<\/i>\u00a0email two business days before the migration. That email informed people of the date their email would migrate and any changes they might experience. We added, \u201cPlease read this email and take appropriate action or you may lose email access.\u201d It also gave instructions to:<\/p>\n We also recommended that users print the email in case they could not access their mailbox after migration, and urged users to complete any necessary steps before the migration date.<\/p>\n We sent the\u00a0Welcome<\/i>\u00a0email immediately after migrating a group of users. We welcomed them to the Exchange Online service, thanked them for their patience, and pointed out differences in the new experience. It was similar to the\u00a0Scheduled\u00a0<\/i>email, but it contained more detail.<\/p>\n Users would obviously not see the Welcome message if their email went down during the migration. Using the Scheduled message, they could find support information on the CSEWeb pages as well as finding their current service on the MySetup page at any time in the process. Finding their current service status told users whether their migration had succeeded.<\/p>\n After migration, users\u2019 mobile devices stopped synchronizing email until users reconfigured them by correcting the EAS address in configuration settings. For users, this was one obvious way to know that they had successfully migrated.<\/p>\n We sent a\u00a0Delayed<\/i>\u00a0email if we had to postpone a migration. We sent it two business days after the scheduled migration date if it was not completed. We informed users that we were still working on their migration, thanked them for their patience, and reminded them that they\u2019d receive another email after migration was complete.<\/p>\n An\u00a0Incident<\/i>\u00a0email was sent when something went wrong. It described the incident and the resolution, and it reminded users that they could check the status of their service on the MySetup page.<\/p>\n During the planning, execution, and follow-up phases of migrating to Exchange Online, we engaged Microsoft employees in other ways.<\/p>\n To attract volunteers for the first migration, we placed notices on the corporate intranet home page and on digital displays around the corporate campus. A week after migration, we sent out a survey that asked people about their migration experience. A month later, we sent a survey that asked about overall performance and satisfaction with the service. We also provided forms for people to make special requests:<\/p>\n Sign up.<\/strong>\u00a0If users wanted to migrate early, they could fill out and submit a sign-up form.<\/p>\n Opt out.<\/strong>\u00a0To request a migration delay, users could submit an opt-out form. Once a particular reason for an opt-out was addressed, targeted communications were sent to that audience informing them that they were eligible for migration and would be migrated in the near future.<\/p>\n Request fulfillment.<\/strong>\u00a0This page offered forms through which users could request changes, such as adding accepted domains and adding an IP address to the allow list. We monitored these requests and collected all necessary information before routing the request to the appropriate team.<\/p>\n Other Microsoft teams were involved in the mailbox migration effort. The purpose of the governance step was to make sure that these teams understood how migration would affect their workloads and responsibilities, and to give them the opportunity to ask questions, raise objections, and suggest changes.<\/p>\n We created a PowerPoint deck that described the project charter for the migration. We sent this deck to the required governance and review channels, also called CABs (change advisory boards) or stakeholders. These partner teams included Networking, Identity (Active Directory\/Accounts\/Federation Services), Legal, and the Support and Helpdesk teams. We needed to make sure that all teams were prepared to support migration.<\/p>\n As the last step in the governance process, we got signoff from stakeholders on the final version of the project charter. At this stage, we engaged our Legal and Human Resources teams to ensure that we were in compliance with local requirements at regional datacenters around the world.<\/p>\n To help user support teams prepare for the calls they would receive during migration, we gave them training materials, email setup steps, descriptions of all known issues and bugs, information about the escalation process, and a SharePoint location to direct users for more information, or to leave feedback on a specific issue or bug.<\/p>\n Tier 1 support is the internal Helpdesk. At this level, users might be using an incorrect password. If Tier 1 cannot solve the problem, they escalate the issue to Tier 2. At this level, a user might need to repair their Outlook profile. When an issue couldn\u2019t be resolved at Tier 2, it escalated to the Microsoft Digital team that worked on the migration, or Tier 3. Issues at this level might be problems such as bugs in the product or issues that need to be fixed at the identity level.<\/p>\n To prepare for migration, we had to define and communicate escalation paths. The escalation paths changed according to the phase of the migration.<\/p>\n We set and closely followed many service-quality metrics, such as the number of mailboxes that had been successfully migrated. Watching the metrics during migration helped us make prompt decisions. The primary metric we watched was Helpdesk ticket count. If we noticed more than a 10 percent increase in tickets, we stopped all migration. This increase indicated a serious problem.<\/p>\n Before we could move forward, we needed to validate and test the migration process and locate business-critical internal applications that depended on email.<\/p>\n Validating migration.<\/strong>\u00a0We created test accounts and migrated them to test migration scenarios using Outlook, using OWA, and on our mobile devices. We developed a validation procedure that guided our testers and focused on different parts of the new service. In one scenario, for example, we tested the Outlook free\/busy schedules of users in different Exchange services.<\/p>\n Testing business-critical applications.\u00a0<\/strong>The many businesses in Microsoft depend on internal business applications that use mailboxes. These are often high-impact applications, which means that if the application (or its email) breaks, it could disable some part of the company. We needed to identify internal apps with mailboxes and prepare them for migration. And someone had to test the applications to find out if we could migrate them to the new service at all.<\/p>\n We located business owners and asked them to test their internal business applications. Once testing was complete and the app was verified on the new service, we could migrate it a later, appropriate date. Any internal business applications that broke during migration had to be reengineered to run on the new service.<\/p>\n We did not know what or where these important applications were when we started this project. Tracking them down required significant amounts of research because some of these applications had no documentation. For others, ownership had changed, making it difficult to find current owners.<\/p>\n We had to carefully prioritize which users to migrate, and when. The nature of a person\u2019s work and the technologies they worked with were considered carefully. Some examples of scheduling choices include:<\/p>\n Engineering first.<\/strong>\u00a0We migrated engineers and IT people in the pilot phase because they work primarily with their own internal teams. If their email went down, only they would be affected. Plus, these people have strong technical skills, were highly motivated for the migration to succeed, and could give us valuable information about any problems they encountered. We wanted to find problems early in the process so that we could learn from them and apply these lessons throughout the migration.<\/p>\n Customer-facing groups later.<\/strong>\u00a0We chose to migrate customer-facing employees\u2014those who often work with partners or customers\u2014later in the migration process, after we had expertise in supporting the migration.<\/p>\n Avoid sensitive weeks.<\/strong>\u00a0We didn\u2019t migrate certain teams at certain times because of the nature or timing of their work. For example, because Sales and Finance employees have special responsibilities near the start and end of months and quarters, we migrated them only during the middle two weeks of a month.<\/p>\n Avoid freeze periods.<\/strong>\u00a0Freeze periods are the last two weeks of the calendar year (December) and the fiscal year (June). These are busy times for some teams\u2014especially Finance\u2014so we did not want to cause issues and escalations during those times. We also avoided migrating members of any product group that was releasing a new product, which was the case with Xbox One.<\/p>\n We created tools to help us keep track of the overall health of the migration. For example, we knew that during migration we would need to find out how many mailboxes were in each of the services (on-premises Exchange and Exchange Online), so we tracked those numbers by setting up PowerShell scripts to copy data to SQL databases. Other reports included:<\/p>\n Delegation families.<\/strong>\u00a0A delegation family consists of users who have delegated permissions to someone else (described in more detail in the Pilot phase section).<\/p>\n Mailbox count.\u00a0<\/strong>The number of migrated mailboxes across all our services and the number of migrated mailboxes classified by office, site, and region.<\/p>\n We also developed:<\/p>\n Outlook troubleshooting tool.<\/strong>\u00a0We built this tool when we discovered that, after migration, up to 10 percent of users needed to repair their profiles. This tool allowed users to change a value deep in the Outlook settings with a single click. We later added functionality to make registry key changes for users when needed.<\/p>\n Other custom tools.<\/strong>\u00a0Before migration, we developed tools that let users fix problems themselves by confirming and setting mailbox permissions, for example. We updated these tools to work with the new Exchange Online service.<\/p>\n We ensured we had a process to track issues and bugs on SharePoint, and that we had a follow-up and closure process for each issue or bug.<\/p>\n The migration was divided into four phases:<\/p>\n Although any corporate IT migration is likely to encounter many of the same challenges, these aspects of our deployment were unique:<\/p>\n During the Pilot phase, volunteers and internal users that would have the least impact on Microsoft business were moved first, giving us time to learn from and refine the migration. We tested our communications plan, refined our user support plan, and fine-tuned preliminary steps so that the process would run smoothly when we automated and expanded the Exchange Online deployment across the company.<\/p>\n Much of the Pilot phase consisted of migrating the Microsoft Office product group and our own IT group. Using lessons learned during this phase, we updated validation testing for new vulnerabilities and specific client scenarios. These scenarios included not only using Outlook and Outlook Web App on desktops and laptops, but using email on mobile devices and other client applications. As a part of this testing, users validated whether all features of the migrated mailbox worked or whether some functionality was broken. We also carefully monitored each batch of migrating accounts and documented Helpdesk issues and escalations.<\/p>\n The most significant lesson learned was that we needed a process to allow migration exceptions. We learned that some people had to temporarily delay migration because something about their environment, such as the applications or technologies they used, was unworkable. We even had to turn down certain volunteers because we found that, for technical reasons, they couldn\u2019t successfully migrate.<\/p>\n We initially followed these steps to migrate mailboxes:<\/p>\n We encountered a number of challenges during the Pilot phase:<\/p>\n In the hybrid (cross-premises) deployment, Azure Active Directory didn\u2019t always synchronize in a timely manner. We had to manually replicate cross-premises items including dynamic distribution groups and\u00a0Send As<\/i>\u00a0mailbox permissions.<\/p>\n User mailboxes were grouped in exception categories that applied to their circumstances. We used Active Directory and PowerShell queries to define the exception-list categories.<\/p>\n Standard<\/strong>: No exceptions applied to these mailboxes. We could migrate them with no known negative effect.<\/p>\n Sales\/Finance organization:<\/strong>\u00a0These people were in the\u00a0Standard<\/i>\u00a0category but were temporarily exempt during sensitive times and freeze periods.<\/p>\n Location:<\/strong>\u00a0Migration was limited to locations within the United States. Some US office locations were on hold until network signoff due to a network egress issue.<\/p>\n Feature requirement:<\/strong>\u00a0The mailbox was temporarily exempt from migration until particular features, such as S\/MIME encryption, was enabled or legacy telephony requirements were resolved. S\/MIME encryption wasn\u2019t supported at the beginning of the migration process, so people who had an S\/MIME certificate had to be migrated after the Exchange team added support for this feature. We also had to create dial plans for legacy telephony users, which took extra time and delayed the migration of these users.<\/p>\n Executives and delegated mailboxes:<\/strong>\u00a0Many executive administrators have delegation authority over their manager\u2019s mailbox so that they can send mail on the manager\u2019s behalf. They might also have delegation authority over conference rooms that have mailboxes, which allows them to accept invitations for the room. This group of executive + admin + conference room is called a\u00a0delegation family<\/i>. We worked carefully with delegation families, engaging executive admins to confirm migration schedules. We verified each individual for whom the executive admins needed to maintain delegation, because some of them reported to more than one executive. We migrated people with delegation relationships separately, but we had to migrate each family in the same batch. People in delegation families got special versions of the\u00a0Scheduled\u00a0<\/i>and\u00a0Welcome\u00a0<\/i>emails, which gave them specific resources to use if they encountered problems with delegation.<\/p>\n Additionally, many conference rooms at Microsoft use displays by Crestron. When we started the migration process, Crestron displays weren\u2019t compatible with Office 365. Once a compatible version of Crestron was deployed, we could migrate the mailboxes of all affected conference rooms.<\/p>\n System accounts:<\/strong>\u00a0Also called service accounts, these were created for business purposes (such as gathering team email), but they aren\u2019t employee mailboxes. We migrated them in a separate batch from their owners but at the same time as their owners. It was important to move them at the same time because cross-premises delegation was not supported. As with delegated mailboxes, we had to engage with owners and then manually move system accounts.<\/p>\n We discovered during the Pilot phase that we had to examine how different parts of Microsoft used various email features so we could enable the corresponding features (if any) in Exchange Online for those users. For example, certain businesses within the company were still using old SMTP services simply because they had been using them for many years.<\/p>\n Before migration, we alerted users to the following tasks:<\/p>\n We sometimes needed to move people back to on-premises Exchange, at least temporarily. In some cases, they had to return to the original service to keep using a feature that was, at the time, unsupported in the online service. In other cases, people were migrated back and had to remain in on-premises Exchange until we found a solution.<\/p>\n During this phase, we automated the migration process to make it more manageable. This allowed us to increase our migration rate to 4,500 mailboxes per week. Early on, we worked with executives to send the\u00a0All-in<\/i>\u00a0email to people who would be migrated. We continually updated user communications (surveys, the Knowledge Base site, and the email cadence) and we started sending a monthly newsletter to update users on migration progress. For this phase, we targeted certain classes of mailboxes to move first:<\/p>\n We limited the number of users migrated to 1,500 per day on Tuesdays, Wednesdays, and Thursdays after 6:00 PM Pacific Time to lessen the impact on Helpdesk. We chose these days because on Mondays people are catching up on their work after the weekends, and on Fridays, we wanted to avoid Helpdesk-issue escalations.<\/p>\n We also started tracking service-quality metrics. An example of a service-quality metric is the Helpdesk ticket rate after migration. We would stop migration if the Helpdesk ticket rate exceeded 10 percent for a given migration batch. Similarly, we continually refined the process for analyzing user feedback and taking action. We set up a weekly check-in with partners to review any impacts they experienced. Finally, we expanded our validation process to include other applications, protocols, and networks.<\/p>\n We encountered new challenges during this phase of migration. Our goal was to stay ahead of issues that affected or may affect the quality of service. We worked to counter negative assumptions about the online service that came from users who migrated during the Pilot phase, which caused some users in this phase to opt out. Despite our best efforts, some migrations weren\u2019t completed on schedule.<\/p>\n It was challenging to migrate large mailboxes (over 10 GB), so we updated our processes to start the migration process a week before they were scheduled. We also mitigated possible delays by setting expectations with users\u2014we targeted a specific date, but in some cases it was delayed two or three days, depending on the mailbox complexity.<\/p>\n During this phase, we made several changes to our processes. The biggest change was automating email communications and the migration process itself. This started with determining mailbox eligibility by using PowerShell to obtain data from Exchange, Active Directory, and HeadTrax (human resources) systems.<\/p>\n To support the migration process and improve the user experience, we developed troubleshooting tools that ran batch files, and we developed client synthetics to establish baseline performance metrics that helped us get a better view of the migration process from the client side. We created and used synthetic (or derived) metrics, which we gathered by running Microsoft Azure and on-premises virtual machines. A client synthetic is an artificial account that emulates a user, which we put through the migration process. By monitoring simulated performance numbers, we could put ourselves in the clients\u2019 shoes and make changes to improve their experience. A synthetic also generates performance alerts, automatically notifying us if something stops running.<\/p>\n At first, we deployed client synthetics to mimic both on-premises (over the WAN) and Azure-based (over the internet) virtual machines to test the performance of client scenarios such as mail flow, load time of free\/busy calendar information, and time required for autodiscovery in Outlook. We connected these client synthetics to Exchange at each datacenter location. We developed a C# application to produce synthetic transactions and analyze the Exchange environment. We also developed a PowerShell app that connected to the Exchange environments to check for known issues and bugs.<\/p>\n All synthetic results and data were stored in SQL Server databases in Azure. We received reports for many worldwide locales, which included performance numbers on Autodiscovery performance, MailFlow performance, Create Rule, Create EAS Partnership, Load Free\/Busy, and Load GAL (Global Address List). For each of those actions, we got metrics on Min Performance, Median Performance, Max Performance, Average Performance, and Availability.<\/p>\n In this phase, migration became an automated run-state process. Although automation succeeded in general we found more challenges, such as users we could not easily group into a category.<\/p>\n During this phase, we continued to use the established automated process that, based on updated eligibility criteria, continually scheduled the migration of 1,500 users daily from Tuesday through Thursday. We also began to migrate some mailboxes on Mondays and Fridays when necessary.<\/p>\n We avoided migrating on weekends because that was when network maintenance and synchronization were most likely to occur. And after learning about the needs, for example, of executive accounts, we established separate projects to migrate more complex mailboxes.<\/p>\n We set up a service team that was responsible for communications, onboarding, service management, engineering, tools, and reporting. We decided to stop synchronizing with our partner teams (the Networking and the Identity teams) to get signoff for migration, and used an automatic escalation process if issues occurred.<\/p>\n We further developed and updated our troubleshooting tools (including collecting metrics), and we continued to add client synthetic metrics to the process. We used synthetics to test performance so that we would know when to stop migrating, if necessary. We also set up a process to collect additional mailbox metrics, including volume usage and client connections.<\/p>\n We continually updated our user communications and feedback processes, and developed new communications to target specific user personas such as admins, which included information about delegation and calendar management.<\/p>\n Some users wanted to migrate early but weren\u2019t eligible to do so. Highly complex mailboxes, such as those belonging to executives and system accounts, had to wait until we could account for cross-premises delegation. (In this case, cross-premises means spanning the on-premises Exchange service and Exchange Online.)<\/p>\n We recommend that larger organizations account for these complex mailboxes in the migration schedule. Smaller organizations without such complex mailboxes may not encounter this specific problem, but you\u2019ll want to closely examine your own edge cases for potential problems.<\/p>\n A pilot migration can help mitigate the risk here. To account for these scenarios, first define eligibility for a pilot migration as precisely as possible, blocking users who don\u2019t meet the requirements. Migrate those users only when the defined requirements are met, or when the dependencies that led to those requirements have been resolved.<\/p>\n We established a separate process with executives and admins to migrate executives, by first examining the migration schedule and confirming the delegation family to ensure that they migrated as a group. For higher-level executives, we created a \u201cwar room\u201d and required key IT staff on-hand from various groups to ensure a smooth transition, or to immediately respond to any issue that might have have surfaced. Fortunately, by that time, migrations were seamless and smooth.<\/p>\n Also called service accounts, system accounts are special non-user accounts created for specific uses. We created system accounts to test migration, for example. We advised mailbox users on how to configure their post-migration mailboxes in certain ways, such as\u00a0how to auto-discover the EWS endpoint<\/a>.<\/p>\n We established a separate process to engage system account owners and to ensure that their mailbox and programmatic uses could migrate. We also developed service guides that described how to code with autodiscovery, and gave them extra time to confirm that they could successfully migrate.<\/p>\n The Accounts team created and used an account-management tool that provisions and manages accounts and mailboxes for new hires. Originally, the tool provisioned new hires in on-premises Exchange. We asked them to update their tool so that it would provision new hires in Exchange Online. We then accounted for the time it would take this team (outside of our IT team) to develop and test this tool.<\/p>\n Once users in on-premises Exchange servers were moved to the cloud, servers could be decommissioned. We started with more than 150,000 mailboxes and migrated more than 99.9 percent to Microsoft Exchange Online. We needed only a fraction of the original on-premises Exchange servers. We decommissioned the rest, removing over 220 servers.<\/p>\n A couple of issues caused us to modify our processes during this phase.<\/p>\n Some users who had Exchange Unified Messaging (EUM), which supplies voicemail, used dial plans. With a dial plan, they could call a toll-free number to retrieve their voicemail. These dial plans were routed through on-premises Exchange servers. We discovered that we needed to reroute these dial plans early in the process to make them point to the new service.<\/p>\n When a legal department places an email account on litigation hold, it means that the contents of the mailbox must be safeguarded for a prescribed retention period. A litigation hold and a 30-day retention period applied to some email accounts during our migration.<\/p>\n In other words, after we moved all the mailboxes from a particular server, we were required to wait 30 days before deleting anything from the server, even though the email was in the new service. After 30 days, we contacted Legal and the HR representative to verify that the retention period had passed. Once they gave their assent, we decommissioned the on-premises Exchange servers.<\/p>\n During this process, we learned that when an account is on litigation hold, the user\u2019s Deleted Items folder doesn\u2019t empty. This causes the mailbox to become very large\u2014in some cases, over 100 GB\u2014and difficult to move. And almost all executive email accounts were on litigation hold.<\/p>\n We worked with Legal teams to determine what email we could remove from a user\u2019s mailbox to reduce its size and make migration more manageable. We also moved content to an archive if the mailbox was too big, in order to start the migration.<\/p>\n We had to delay or cancel the migration of certain mailboxes due to special circumstances, often because of the nature of a user\u2019s job or because of applications and features that caused technical issues. In many cases, we found that migration disabled the mailboxes that we moved. We then had to migrate them back to on-premises Exchange to investigate and solve the problem.<\/p>\n In order to accommodate\u00a0sending and receiving limits in Exchange Online<\/a>, some high-volume senders remained on our on-premises Exchange infrastructure while we identified alternative solutions to meet the needs of these users sending scenarios. System accounts sending line-of-business alerts and notices only to mailboxes within the tenant can use\u00a0Direct Send<\/a>. Those who require advanced analytics, or must send to recipients outside the tenant, must either provision their own SMTP service or engage a third-party SMTP provider.<\/p>\n When another company was sued for overtime pay because its employees checked work email in their off-hours, Microsoft took steps to avoid such a lawsuit. Our original solution in on-premises Exchange was to block access to Outlook when people were not on the corporate network and at specific times of day. However, we didn\u2019t have a post-migration solution in Exchange Online to block access in this way.<\/p>\n Eventually, the decision was made to let these people check mail after hours and be paid for it. When we got official signoff from HR and Legal, we migrated these people, who now have the same access to email as other employees.<\/p>\n At the time of migration, Office 365 was limited to datacenters in the region where the account was opened. For example, users on the Microsoft Redmond campus were subscribed to a tenant in North America, which meant that we could only use datacenters hosted in North America.<\/p>\n With Office 365\u2019s current Multi-Geo capabilities, this is no longer the case. Note, however, that using regional datacenters can head off any compliance or latency issues, and that cross-regional setup may require extra resources to ensure compliance and performance.<\/p>\n In our on-premises Exchange installation, people could use OWA to reset their passwords rather than connecting to the corporate network through Windows. However, Office 365 doesn\u2019t let users reset their passwords in this way, so migrated users lost that capability. The solution was for the Identity team to implement a self-service password reset option. (The Identity team owns Active Directory and the accounts process at Microsoft.) This solution was intended primarily for partners, such as a Samsung employee who works in a Microsoft office and uses a Microsoft mailbox. We had to wait for the Identity team to port a solution for them before we moved them to Exchange Online.<\/p>\n In the process of migrating hundreds of thousands of on-premises Exchange mailboxes to Exchange Online, we learned several valuable lessons. Applying these lessons as best practices can help smooth the transition for those who plan to make the same migration.<\/p>\n These lessons, compiled by our Service Exchange Manager, mostly fall under one of three headings: technical preparation to smooth out the path before the migration; ensuring best practices are adhered to during the migration; and communicating clearly and effectively with end users.<\/p>\n Learn about dependent services and service configurations.<\/strong>\u00a0Familiarize yourself with other dependent services, such as your network infrastructure, DirSync (directory synchronization of Active Directory), corporate account creation, and how your service and client protocols interact with them end-to-end. Get acquainted, too, with current service configurations and settings, and any other legacy artifacts.<\/p>\n In addition, learning to use PowerShell can ensure that you have fast access to the information you need, when you need it. And an\u00a0IdFix tool<\/a>\u00a0can notify you of any identity issues that should be resolved beforehand.<\/p>\n Profile and snapshot user and system mailboxes.<\/strong>\u00a0Profile mailboxes to determine beforehand the average mail volume through Exchange Client Access Server (CAS) and transport logs, and to determine migration order and mailbox volume. Snapshot mailboxes prior to migration to ensure that you can carry over attributes, permissions, and rules once migration is complete.<\/p>\n Plan for additional network traffic and large mailboxes.<\/strong>\u00a0Network issues that prevent the synchronization of large mailboxes can bring migration to a halt if not accounted for. Ensure that your network is capable of handling the additional traffic.<\/p>\n Learn how to copy mailbox items to an archive and to remove email data that was delivered during particular times. This should minimize disruption when migrating mailboxes on litigation hold, for example.<\/p>\n Adjust rule quotas as necessary.<\/strong>\u00a0Exceeding Outlook Rules quotas may result in those rules being disabled after migration. For users with significant amounts of rules (30 or more), consider adjusting the quota. Make sure that all users have updated Outlook to the latest version, and that they\u2019ve saved their Outlook rules to the server (or otherwise backed them up). Document instructions for technicians and ambitious users on how to repair or rebuild Outlook profiles.<\/p>\n Ensure access to your own tools and adjust access in your on-premises environment.<\/strong>\u00a0Make sure you can access the necessary internal tools via the internet, and that those tools don\u2019t require a VPN to access. Do the same for Microsoft Azure, SharePoint Online, or Microsoft SQL Server, if applicable. Verify that there are no other restrictions to that access that might block migration.<\/p>\n You\u2019ll also want to adjust user permissions at the earliest possible time. For example, after a majority of users were migrated from our on-premises environment, we removed permissions from support teams who no longer needed access to provide user support. As security standards and modern authentication matured, we added two-factor authentication and altered the role-based access control to limit access to designated administrator service accounts.<\/p>\n\n
Completion: Welcome email<\/h4>\n
Follow up: Delayed email<\/h4>\n
Incident email<\/h4>\n
Other communications<\/h3>\n
Marketing, surveying, and special requests<\/h4>\n
Establishing governance for a smooth transition<\/h2>\n
Preparing support teams is vital<\/h3>\n
Defining escalation paths<\/h4>\n
\n
Creating service-quality metrics<\/h4>\n
Validating migration and testing business-critical applications<\/h4>\n
Selecting users and scheduling migration<\/h4>\n
Creating tools and reports<\/h4>\n
Tracking issues and bugs<\/h4>\n
The migration journey<\/h2>\n
\n
\n
Phase 1: Pilot<\/h3>\n
Migration steps<\/h4>\n
\n
\nAs we continued to migrate users and discover issues, we added more steps to the process, including:<\/li>\nChallenges<\/h4>\n
\n
Creating the exception list<\/h4>\n
Pilot phase: What we learned<\/h4>\n
User tasks<\/h5>\n
\n
Rollback procedure<\/h5>\n
Phase 2: Initial volume<\/h3>\n
\n
Challenges<\/h4>\n
Updating our processes<\/h4>\n
Phase 3: Continuous volume migration<\/h3>\n
Challenges<\/h4>\n
Executive migration<\/h5>\n
System account migration<\/h5>\n
New tool for account management<\/h5>\n
Phase 4: Managing edge cases<\/h3>\n
Addressing dial plans<\/h4>\n
Working with litigation hold and email data retention<\/h4>\n
Managing other exceptions<\/h4>\n
Office 365 email sending limits<\/h5>\n
Retail hourly<\/h5>\n
Worldwide datacenters<\/h5>\n
Loss of password reset through OWA<\/h5>\n
Lessons learned<\/h2>\n
Before migration: Eliminating technical hurdles<\/h3>\n