Migrating On-Premises Exchange to Office 365: A Step-by-Step Guide

Moving Exchange Server to Microsoft 365 is an infrastructure project, not simply a mailbox export. The work includes identity, DNS, mobile devices, mail flow, security controls, retention, licensing and user communications. A sound migration plan reduces downtime and avoids the common mistake of treating Exchange Online as a hosted copy of the existing server.

For Australian organisations, the timing and operating environment also matter. Staff in Sydney and Melbourne may work across Australian Eastern Standard Time and daylight saving, while Brisbane teams do not change clocks. School holidays, end-of-financial-year workloads and NBN or site-connectivity limitations can affect the best migration window.

Microsoft operates Australian data centre regions, which may assist with data residency and regulatory planning. However, location alone does not settle every privacy obligation. The Privacy Act 1988, the Notifiable Data Breaches scheme and, for commercial email, the Spam Act 2003 should be considered alongside contractual and industry requirements.

The safest approach is a staged transition. Inventory the current environment, prepare Microsoft 365, test a small pilot group, migrate mailboxes in batches and retire the old server only after all dependencies have been removed.

Assess The Existing Exchange Environment

Begin with a complete inventory of Exchange servers, databases, mailbox sizes, aliases, shared mailboxes, distribution groups, public folders, connectors and transport rules. Record applications that send email, including accounting systems, monitoring platforms, scanners, line-of-business software and websites. An application that sends through an Exchange receive connector can be overlooked during a mailbox-only migration.

Check the health of Active Directory and DNS before introducing cloud synchronisation. Remove stale accounts, resolve duplicate proxy addresses and confirm that every user has a routable sign-in name. Review service accounts carefully: some may need application identities or authenticated SMTP alternatives rather than ordinary user licences.

This is a suitable point to bring in external architecture support if the environment has multiple sites, hybrid requirements or regulatory constraints. Karl Katzke’s IT consulting work covers infrastructure planning, cloud migration and systems architecture, which are the decisions that determine whether a fast cutover or a longer hybrid deployment is appropriate.

Prepare Microsoft 365 And Identity

Create the Microsoft 365 tenant and verify the organisation’s domain. Do not change all mail-related DNS records immediately. Domain verification usually requires a temporary TXT record, while MX, Autodiscover, SPF, DKIM and DMARC changes belong to the mail-flow stage.

Decide whether users will authenticate in the cloud or through synchronised identities. Microsoft Entra Connect, formerly Azure AD Connect, can synchronise users, groups and password hashes from on-premises Active Directory. Confirm that the selected sign-in method meets internal security requirements, and enable multifactor authentication through a controlled rollout rather than surprising staff during migration week.

Licensing should be mapped before batches are created. Exchange Online plans differ in mailbox capacity, archive features, compliance capabilities and client rights. Shared mailboxes often do not need a full licence within their limits, but an archive, litigation hold or larger storage requirement can change that assessment.

Configure DNS, Security And Mail Flow

Lower DNS record time-to-live values ahead of the cutover, where the existing provider permits it. Publish SPF with a single coherent policy, configure DKIM for the Microsoft 365 domain and create a DMARC record in monitoring mode before moving towards quarantine or rejection. Include legitimate third-party senders such as marketing platforms and ticketing systems in the assessment.

Choose whether inbound mail will flow directly to Exchange Online Protection or pass through an existing gateway. If a secure email service, firewall or filtering appliance remains in use, document both inbound and outbound connectors. Test sender rewriting, TLS requirements, relay permissions and message-size limits with real examples.

Australian offices can expose practical timing issues. A business operating in Perth, Adelaide and Sydney may need a cutover window that suits several time zones, while daylight-saving changes can complicate scheduled jobs. Validate that mail-enabled devices and applications use the correct time source and do not depend on a hard-coded local offset.

Use the pilot to review links, attachments and filtering decisions as well as ordinary messages. Security teams should distinguish legitimate business content from suspicious domains; even unusual external material, such as external content hygiene, should be handled through documented URL inspection and quarantine policies rather than informal exceptions.

Select A Migration Method

For a small organisation with straightforward requirements, an Express Migration or cutover approach may be suitable. Larger environments commonly use staged migration, IMAP migration or a hybrid configuration. IMAP transfers message data but generally excludes calendars, contacts, tasks and mailbox permissions, making it a poor fit when users rely heavily on Outlook collaboration features.

A hybrid deployment keeps on-premises Exchange and Exchange Online connected during the transition. It supports mailbox moves, shared address lists and coexistence, but it adds configuration and operational overhead. Check Microsoft’s current support matrix for the installed Exchange version and cumulative update before starting a hybrid configuration.

Create migration batches based on business function and dependency rather than alphabetical order. Keep executives, reception, finance and automated systems in a deliberately controlled group. Start with technically confident users who can provide useful feedback, then move larger groups after the pilot proves stable.

Run The Pilot And Migration Batches

Select a representative pilot that includes Windows and macOS Outlook users, mobile devices, shared mailboxes, remote workers and at least one person who works from a different Australian time zone. Confirm that email, calendar sharing, delegated access, meeting responses, contacts and archive access work as expected.

Communicate the user experience before moving each batch. Outlook may request a restart or new sign-in, mobile applications may need account removal and re-addition, and cached credentials can produce confusing prompts. Provide a short support procedure for password issues, missing folders, delayed messages and broken autocomplete entries.

Use migration reports rather than assuming that a completed batch is a successful batch. Investigate skipped items, corrupted messages, oversized attachments and failed folders. Keep the source mailbox available until the final synchronisation and validation are complete, while preventing users from continuing to work in two locations.

Automation can reduce repetitive preparation work, especially when many servers or test systems are involved. Techniques described in F# automation can be adapted to generate configuration checks, compare inventories and flag inconsistent settings before a production move.

Retire Exchange And Operate The New Platform

After the final mailbox move, confirm that no application, device or connector still depends on the on-premises server. Review SMTP relay sources, scan-to-email devices, multifunction printers, monitoring alerts and legacy scripts. Update them to use an authenticated and supported delivery method, Microsoft Graph where appropriate, or a controlled relay service.

Remove old DNS records only after observing mail flow for an agreed period. Then address Exchange decommissioning carefully. A hybrid configuration may require a supported procedure for removing the last Exchange server while retaining directory management for mail-enabled attributes. Do not simply shut down the server and delete its Active Directory objects.

Build ongoing monitoring around message trace, Defender alerts, delivery failures, sign-in events, licence assignments and DMARC reports. Retention labels, litigation holds, eDiscovery permissions and backup expectations should be documented. Microsoft 365 availability does not remove the organisation’s responsibility to define recovery, governance and access-review processes.

Operational Checks Before Cutover

A concise readiness review helps turn a complex migration into a controlled change. Complete these checks before approving the first production batch:

• Confirm every mailbox, alias, shared mailbox and distribution group has an owner.
• Test SPF, DKIM, DMARC, inbound delivery, outbound delivery and external replies.
• Record all SMTP relay devices, applications, printers and monitoring services.
• Validate multifactor authentication, licensing, mobile access and delegated permissions.
• Confirm retention, archive, legal hold, privacy and data breach response requirements.
• Prepare user communications, service desk scripts and a documented rollback decision.
• Schedule the change with Australian time zones, support coverage and business deadlines in mind.

Keep a migration log containing dates, batch membership, errors, DNS changes, approvals and post-move checks. That record is valuable for troubleshooting and provides evidence that privacy, security and operational controls were considered rather than added after an incident.

A successful move leaves the organisation with fewer servers to maintain, clearer identity controls and better visibility of mail security. Start with the inventory, prove the design with a pilot, and move each batch only when its dependencies and recovery path are understood.