Migrating to Microsoft 365: A Step-by-Step Guide for SMBs

A Microsoft 365 migration is often sold as a few clicks in a wizard. The reality is rather different. For an SMB organisation of 25 to 100 employees, it involves email, documents, shared mailboxes, distribution lists, mobile devices, local files, applications that talk to the old environment, and — not least — people who simply want to keep working.

This is the step-by-step plan we follow at eMotivz for every Microsoft 365 migration, along with the pitfalls we encounter most often.

Why migrate to Microsoft 365?

For SMBs, the reasons to migrate to Microsoft 365 have become hard to ignore:

• End-of-life Exchange Server. Many organisations are still running an Exchange 2016 or 2019 that will fall out of support before long. Carrying on without security updates is no longer an option for anyone who has to satisfy NIS2 or a cyber insurer.
• Hybrid working demands the cloud. VPN tunnels to reach internal file shares work for 5 people, but not for an organisation that has become structurally hybrid.
• Microsoft Copilot requires Microsoft 365. Anyone who wants AI assistants in their workplace cannot avoid a modern tenant with properly indexed data.
• Security requirements are getting tougher. Conditional Access, MFA and device management are standard today — no longer optional.

Whether you talk about a Microsoft 365 migration or use the older term Office 365 migration, the journey is the same. Microsoft changed the name in 2020, but the underlying cloud platforms (Exchange Online, SharePoint Online, OneDrive, Teams) have simply continued to evolve.

The step-by-step plan in six phases

Phase 1 — Discovery and assessment

Before a single line is typed into a wizard, we map out your existing environment. What exactly is running today? Which version of Exchange, which SharePoint, which file servers? How many mailboxes, how much data, how many distribution lists? Which mobile devices are your people using?

What we frequently find:

• Abandoned mailboxes that have been receiving email for years for people who no longer work there
• Distribution lists with external addresses that no longer exist
• Mailboxes of hundreds of gigabytes built up over 15 years of PST archives
• Macro-heavy Excel files that no longer work without a local Outlook
• A local file server with a folder structure 12 levels deep

An honest discovery takes two to four days for an organisation of 50 employees. Do not skip this phase. Anyone who starts a migration blind discovers halfway through that half of their assumptions were wrong.

Phase 2 — Tenant design and licensing

Which Microsoft 365 tenant will it be? For SMBs it almost always comes down to a choice between:

• Microsoft 365 Business Basic — cloud apps only, no Office desktop. Inexpensive, but rarely sufficient for the whole organisation.
• Microsoft 365 Business Standard — desktop apps included, plus the core functionality of Teams/SharePoint/OneDrive.
• Microsoft 365 Business Premium — everything in Standard, plus Microsoft Intune, Microsoft Defender for Business, Microsoft Entra ID P1 and advanced email security through Defender for Office 365.

For anyone seriously considering Microsoft 365 for SMBs, Business Premium is usually the rational starting point. The combination of device management (Intune) and endpoint protection (Defender for Business) is the difference between a workplace your cyber insurer will accept and one that represents a major risk.

In this phase we also fix the tenant name (yourcompany.onmicrosoft.com), the primary domain, the identity strategy and the naming conventions for groups and SharePoint sites.

Phase 3 — Identity migration

This is where it gets interesting. Most SMB organisations come from a local Active Directory or from standalone user accounts. The target architecture is Microsoft Entra ID (the new name for Azure AD).

Three scenarios:

1. Cloud-only — a clean start, with users created directly in Entra ID. Recommended for organisations without a local AD that still needs to be maintained.
2. Hybrid with Entra Connect — the local AD remains the source of truth, and accounts are synchronised to Entra ID. Needed as long as there are still applications that authenticate against local AD.
3. Hybrid with cloud authentication — synchronisation, but passwords are validated in the cloud via Password Hash Sync. By far the most pragmatic middle ground.

The move from Azure AD to Entra ID in 2023 was purely a rebranding — under the bonnet it is still the same service. But a great deal of documentation, scripts and integrations still refer to the old name, and that causes confusion.

Phase 4 — Mailbox and data migration

This is where most of the time goes. The approach differs depending on the source:

• From Exchange Server (on-premises) — usually via a hybrid migration or a cutover migration. With more than 150 mailboxes it is almost always hybrid; with fewer than 50, cutover is perfectly fine. In between: it depends on the complexity.
• From IMAP (cPanel, an old hosting provider) — an IMAP migration is technically straightforward, but you lose calendars, contacts and rules. Expect manual work.
• From Google Workspace — Microsoft provides solid tooling here, including mapping Gmail labels to Outlook folders.

For documents and SharePoint:

• Local file servers to SharePoint/OneDrive — use the Microsoft Migration Manager. More important than the tooling: seize the opportunity to tidy up the folder structure. The cloud is not the place to preserve 15 years of clutter.
• Personal drives to OneDrive — automatically via Known Folder Move. But watch out for users with 200 GB of personal photos on the company laptop.

Plan the migration in waves. 10 to 25 users per wave, with a week between each wave to spot problems before they affect the entire organisation.

Phase 5 — Security and governance

A Microsoft 365 tenant out of the box is not secure. The default settings are designed to maximise compatibility, not security. As standard, we configure:

• MFA for all users — no exceptions. Conditional Access policies ensure MFA is enforced, including for admins.
• Conditional Access — access only from known devices or known locations. Sensitive roles only from compliant devices.
• Microsoft Intune — all devices enrolled, security policies active, BitLocker enforced.
• Microsoft Defender for Business — endpoint protection on every workplace, with central incident management.
• Data Loss Prevention — baseline rules that prevent sensitive data being shared externally by accident.
• Retention and backup — at a minimum a retention policy for mail and SharePoint, and a third-party backup for anyone with compliance obligations.

Do not skip this step. We have seen an organisation become compromised within three weeks of a hastily executed migration because MFA was going to be rolled out "later".

Phase 6 — Adoption and aftercare

The technical migration is finished, but the migration itself is not. People have to learn to work with Teams instead of personal chat apps, with SharePoint instead of a folder structure, with OneDrive instead of a USB stick.

Allow for:

• A short introductory training session for every user (30 to 45 minutes)
• A more in-depth session for "champions" in each department
• A first-aid form or helpdesk channel for the first two weeks
• Periodic health checks on the use of Teams, SharePoint and OneDrive

Five pitfalls that break your migration

1. Underestimating mailbox size. A user with 80 GB of mail having to go over a 50 Mbit/s upload takes days. Cumulatively across 50 users, that suddenly becomes a bottleneck. Plan your network and bandwidth in advance.

2. Forgetting shared mailboxes and distribution lists. In almost every discovery we find shared mailboxes that nobody remembers, yet which are used by external processes. A missed shared mailbox causes an unexplained gap in order processing three months later.

3. Ignoring PST files. People have spent years "archiving" mail away into PST files on local drives. That data disappears unless you deliberately set up the migration to upload the PSTs as well.

4. No plan for printers and multifunction devices. Many older multifunction devices authenticate with basic auth against Exchange for scan-to-mail. Microsoft has phased out basic auth. Anyone without a plan for scan-to-mail discovers after the cutover that the printer no longer scans.

5. No pilot. "We'll do all 50 in a single weekend" goes well once and badly once. Start with 5 volunteers from different departments, resolve the problems, and then scale up. The extra week costs less than a single escalation to the entire organisation.

What does eMotivz do here?

We guide Microsoft 365 migrations for SMB organisations in Lelystad, Flevoland and the central Netherlands. As a Microsoft Cloud Solution Provider (CSP partner), we deliver not only the migration project itself, but also the licences, the management and the ongoing support that follows.

A typical project for an organisation of 25 to 75 employees takes six to twelve weeks — depending on the complexity of the source, the number of applications that need to be adapted, and the pace at which your people can keep up.

Want to know where your organisation stands? Arrange a no-obligation introductory meeting or take a look at our Microsoft 365 Modern Workplace and Microsoft 365 management solutions for more detail on what we deliver as standard.