Take an inventory
Anything left off the inventory may come to light only after the move, often through the person it belonged to. The Google Admin console holds everything below. Each row says where to find it and why it matters.
- People
- WhereDirectory, Users, then Download users (CSV, JSON or a Google Sheet)
- Why it mattersEvery person needs a Microsoft 365 account, licensed at the point the migration tool expects. Download a list of users
- Aliases and domain aliases
- WhereDirectory, Users, then each user's record; note any domain aliases too
- Why it mattersEach user can have up to 30 aliases, and a domain alias gives every user an extra address. Each address needs a home in Microsoft 365. Email aliases
- Groups
- WhereDirectory, Groups (Groups administrator privilege)
- Why it mattersEach group address, such as sales@ or support@, needs a Microsoft 365 equivalent: a group, a distribution list or a shared mailbox. The groups list
- Storage per person
- WhereMenu, Storage, View all users; or Reporting, User reports, Apps usage for Gmail and Drive columns
- Why it mattersSizes the move and flags anyone whose mail exceeds a Microsoft 365 mailbox. Figures can lag up to 24 hours. Review storage use
- Shared drives
- WhereApps, Google Workspace, Drive and Docs, Manage shared drives (Drive & Docs administrator)
- Why it mattersEach shared drive needs a destination in Microsoft 365, such as a SharePoint site, decided before files move. Manage shared drives
- Rooms and resources
- WhereDirectory, Buildings and resources, Overview, then Open under Resource management, and Download (CSV)
- Why it mattersRooms become resource mailboxes in Microsoft 365; bookings are planned separately. Buildings and resources
- Apps that use Google sign-in or data
- WhereSecurity, Access and data control, API controls, Manage App Access
- Why it mattersAnything that signs people in with Google, or reads Google data, depends on those Google accounts. Each one needs a plan before the accounts close. Apps with access
- Tools with domain-wide access
- WhereSecurity, Access and data control, API controls, Manage Domain Wide Delegation
- Why it mattersDomain-wide delegation lets a tool reach every user's data, and old backup or migration tools can still hold it. Google recommends reviewing these tools and deleting the ones no longer in use. Domain-wide delegation
Two sizing cautions. Google-native files (Docs, Sheets, Slides) created or last changed before May 2022 report no size through Google's API, so tools can undercount them (Microsoft Learn: Migration Manager FAQ). And storage figures in the Admin console can lag by up to 24 hours (Google Workspace Admin Help).
Choose the licenses
Every person who signs in needs a license. The license sets their mailbox size, file storage and security features. The Business plans allow up to 300 licenses in total, and Enterprise plans have no seat limit. Business and Enterprise plans can be combined in one Microsoft 365 organization (the tenant), so each person can have the plan their work needs (Microsoft Learn: Plan options).
| Plan | Desktop apps | Mailbox | Archive | OneDrive | Also includes |
|---|---|---|---|---|---|
| Business Basic | No, web apps | 100 GB | 50 GB | 1 TB | Entra ID Free |
| Business Standard | Yes | 100 GB | 50 GB | 1 TB | Entra ID Free |
| Business Premium | Yes | 100 GB | Auto-expanding, up to 1.5 TB | 1 TB | Entra ID P1 (Conditional Access), Intune, Defender for Business, Defender for Office 365 P1 |
| Microsoft 365 E3 | Yes | 100 GB | Auto-expanding, up to 1.5 TB | 1 TB, up to 5 TB | Exchange Online Plan 2 |
| Microsoft 365 E5 | Yes | 100 GB | Auto-expanding, up to 1.5 TB | 1 TB, up to 5 TB | Purview suite: classification, retention, eDiscovery (Premium) |
| Microsoft 365 F3 | No | 2 GB | Not available | 2 GB | Frontline staff on mobile devices |
The Business family allows up to 300 licenses in total across Business Basic, Standard, Premium and Apps for business; Enterprise and Frontline plans have no seat limit. Sources: Plan options for desktop apps, seat limits and the E3 and E5 extras; Exchange Online limits for mailbox and archive sizes; OneDrive service description for OneDrive storage; Business Premium security for Entra ID, Intune and Defender; Frontline licensing for who F3 is for.
Which one fits
- Business Basic suits people who work in the browser and on their phone. There are no desktop Word, Excel or Outlook apps.
- Business Standard adds the desktop apps, including Outlook, for people who work on a laptop or desktop.
- Business Premium adds the security that lets an admin require multifactor sign-in by rule, manage laptops and phones, and keep an archive that grows with the mailbox. It also includes Litigation Hold, retention policies and data loss prevention (Microsoft Learn: Exchange Online features by plan).
- Enterprise E3 or E5 fit companies above 300 people, or a need that Business Premium does not cover, such as the Purview suite in E5. Check the specific feature in Microsoft's current plan tables before choosing Enterprise for it.
- Frontline F3 is for staff who work mostly on mobile devices with customers. Its 2 GB mailbox rarely holds the mail of someone who works at a desk.
Check mailbox sizes against the inventory
Compare each person's Gmail storage with the plan's mailbox. Business plan mailboxes rose from 50 GB to 100 GB in a rollout that ran from June to September 2026. A custom size set by an admin stays as it was, and a standalone Exchange Online Plan 1 license stays at 50 GB (Microsoft Exchange Team blog). Anyone whose mail exceeds the mailbox needs an archive-capable plan, such as Business Premium or E3 (Microsoft Learn: Exchange Online limits), and a migration that splits their mail between the mailbox and the archive. Microsoft's own route for mailboxes over 100 GB is Large Mailbox Onboarding, run in PowerShell with a mapping of folders or date ranges. The date ranges must be continuous, or the items in a gap are missed without warning (Microsoft Learn: Large mailbox migration). Microsoft also offers a mailbox analysis, run in Exchange Online PowerShell, that helps find oversized mailboxes before a migration starts (Microsoft Learn: Mailbox analysis).
Shared and room mailboxes need no license up to 50 GB. A shared mailbox needs an Exchange Online Plan 2 license to grow to 100 GB, a license that covers Litigation Hold to be placed on hold, and a license for any advanced retention feature. Every person who opens it needs an Exchange Online license of their own (Microsoft Learn).
SharePoint storage is pooled across the organization. On Business and Enterprise plans, SharePoint gets 1 TB plus 10 GB per license, and an F1 or F3 tenant gets 1 TB in total. Each person's OneDrive is not counted in either total, and a tenant that stays over its limit risks becoming read-only (Microsoft Learn: SharePoint limits). Compare that pool with the shared drive total from the inventory.
Arrange the access
A migration reads from Google and writes to Microsoft 365, so it needs permission on both sides. The roles below are the ones each step requires with the tools named here. Grant the least that works, write down who granted what and when, and remove it when the move is done.
Google side
- A super administrator grants domain-wide delegation, which lets a migration tool read every user's data (Domain-wide delegation), and installs Marketplace apps for the whole organization, which Migration Manager needs (Migration Manager: Connect to Google).
- Narrower admin roles cover the inventory: Storage administrator for storage use, Reports administrator for the usage report, Groups administrator for groups, Drive & Docs administrator for shared drives (Storage, Apps usage, Groups, Shared drives).
- Microsoft's Exchange Online migration needs a Google administrator who can create a Google Cloud project and service accounts. The migration uses a service account and a key created in that project (Microsoft Learn: Google Workspace migration prerequisites).
Microsoft side
- Domain Name Administrator adds and verifies the domain (Add a domain).
- SharePoint Administrator, with a SharePoint license, pre-provisions OneDrive (Pre-provision OneDrive).
- Privileged Role Administrator can approve the application permissions a migration app asks for, for the whole tenant (this approval is called admin consent). Cloud Application Administrator, AI Administrator and Application Administrator can approve most permissions, but not Microsoft Graph application permissions (Microsoft Learn: Grant tenant-wide admin consent).
- Microsoft's own tools need their own roles. The Exchange Online migration for Google Workspace moves mail, calendars and contacts. It needs at least the Recipient Management role group (Perform a Google Workspace migration, prerequisites). Migration Manager moves Drive files. A SharePoint admin, a Microsoft 365 Migration Administrator or a Global admin runs it (Migration Manager for Google).
Prepare the user accounts
Accounts come before data. In this order:
- 1Add and verify the domain. Verification usually takes minutes, up to 48 hours at some registrars. Microsoft's order is users after the domain and before the MX record changes (Microsoft Learn: Add a domain). Leave MX pointing at Google until cutover; the DNS cutover guide covers why.
- 2Create each person with a sign-in name that matches their email address. Microsoft recommends the sign-in name (UPN) match the primary email address, at the primary domain (Microsoft Learn, Google Workspace migration prerequisites).
- 3Assign licenses in the order the migration tool expects. Tools that copy into existing mailboxes need the license first. After a license is assigned, the mailbox usually appears within 30 minutes, and can take up to 24 hours (Microsoft Learn). Microsoft's own Exchange Online migration works the other way round: each person starts as a mail user, the batch turns them into mailboxes when it starts, and the license is assigned after that, within 30 days (Microsoft Learn: Google Workspace migration with PowerShell).
- 4Give every other address a home. Shared mailboxes for role addresses, room mailboxes for rooms, groups for group addresses, and aliases on the right mailbox for each Google alias. After cutover, Microsoft 365 can reject mail to an address it does not know.
- 5Pre-provision OneDrive. A OneDrive is created the first time its owner opens it, so files cannot move into it before then unless it is pre-provisioned. The accounts must be licensed and allowed to sign in. Microsoft's script handles 199 accounts at a time, and for many users the OneDrives can take several days to appear (Microsoft Learn: Pre-provision OneDrive). The command only queues each request, and the OneDrive is created later (Microsoft Learn: Request-SPOPersonalSite). Before files move, check that each one appears in the list of OneDrive URLs Microsoft points to (Microsoft Learn).
- 6Plan the first sign-in. Decide how each person receives their new password and sets up multifactor sign-in, and test it with one person before the day.
Decide what moves, and what stays
Check Google Vault before anything is deleted
Vault holds keep data indefinitely and take precedence over retention rules. Vault keeps no separate archive, so a retention rule deletes data from the live service (Google: How retention works). Deleting a user also deletes their data, including data held by Vault. An Archived User license keeps it (Google: Preserve data for users who leave). Google warns that once the subscription is canceled, users' Workspace data is deleted and cannot be restored. The same page describes other paths for some subscriptions, such as letting users keep their My Drive data in personal accounts, so check which one applies before canceling (Google: Cancel Google Workspace). If anyone's data is under a legal hold, settle how it is kept before any account is closed, for example a former employee's mailbox kept for a dispute.
Decide whether to keep a full export
Google's Data Export tool exports every user's data, including deleted data retained by Vault, to Google Cloud Storage. It needs a super administrator account at least 30 days old with 2-Step Verification on, typically takes 72 hours and can take up to 14 days. In the Google-provided bucket, the export is deleted 60 days after it starts, so copy it to storage the company controls before then; organizations with Google Workspace Assured Controls can export to a bucket they own. Organizations above 1,000 users contact Google first. The export runs while the subscription is active: data from Google's core services is left out once it is canceled or suspended (Google: Export all your organization's data).
Check files against SharePoint's limits
A file can be up to 250 GB, and the full path including the file name can be up to 400 characters (Microsoft Learn: SharePoint limits). Names cannot contain " * : < > ? / \ |, start or end with a space, or use reserved names such as CON, desktop.ini or names starting with ~$ (Microsoft Support: Restrictions and limitations). A migration tool can set a lower bar: Microsoft's Migration Manager lists paths longer than 300 characters as ones it cannot migrate (Microsoft Learn: Migration Manager reports). Long paths usually come from deep folder trees in Google Drive, so find them before the move.
Know what does not carry over
Some Google features have no equivalent in Microsoft 365, or work differently there. What moves where maps each item to its new home, so what stays behind is a decision made before the move.
Tell your people
Even when every message and file arrives, people work in new places afterward. Three messages to staff cover the change:
- Two weeks out: the date, why the company is moving, and what stays the same.
- A few days out: when to stop working in Gmail and Drive, and when to stop changing files there.
- The first morning: how to sign in, where mail, files and calendars now are, how labels appear in Outlook, and who to ask for help.
A timeline, week by week
For a company of a few dozen people, four weeks leaves room for each step. A larger company usually needs more time in the first two stages.
Four weeks out
- Take the inventory: people, addresses, groups, storage, shared drives, rooms, apps.
- Choose licenses from the inventory, and check anyone whose mail exceeds a mailbox.
- Decide what moves and what stays, and check Vault holds.
Three weeks out
- Add and verify the domain in Microsoft 365. Leave the MX record, which routes the domain's mail, pointing at Google.
- Create user accounts with sign-in names that match their email addresses, and assign licenses in the order the migration tool expects.
- Create shared mailboxes, room mailboxes, groups and aliases.
Two weeks out
- Pre-provision OneDrive for everyone whose files are moving.
- Grant the access the migration needs, on both sides, and write down who granted what.
- Move a few mailboxes first, and check them with the people who own them.
One week out
- Tell everyone the date, what changes, and what to do on the first morning.
- Lower the MX record's TTL (how long other servers may cache it) to one hour or less.
- Agree when each kind of data stops changing in Google.
Cutover and after
- Switch the MX record to Microsoft 365, following the DNS cutover guide.
- Keep Google accounts active until a final mail pass and a closing check have passed.
- Export a full backup if you want one, then remove the access granted for the migration.
Checklist
- Users, aliases, groups, rooms and shared drives listed
- Storage per person checked against the mailbox and OneDrive sizes
- Apps using Google sign-in or Google data listed, each with a plan
- Licenses chosen and bought, within the 300-seat Business limit or on Enterprise plans
- Domain added and verified in Microsoft 365, MX still at Google
- Every person has an account whose sign-in name matches their email address
- Shared mailboxes, room mailboxes, groups and aliases created
- OneDrive pre-provisioned for everyone whose files are moving
- Migration access granted on both sides, and recorded
- Vault holds and retention checked; nobody with held data is deleted
- Files checked against SharePoint's limits and the migration tool's limits
- A few mailboxes moved first and checked by their owners
- Staff told the date, the changes and the first-morning steps
- MX TTL lowered at least a day ahead
How MigrationSanity prepares the move
MigrationSanity runs the move for you, and the preparation is written down before any data moves. You approve a written plan, see a dry run that copies nothing, and check a few of your own people's mail, calendars and contacts in Microsoft 365 before everyone else follows.
Before anything copies
- A migration plan lists every person, mailbox and shared drive, where each one lands, and the dates for the proof batch (the few people who move first), the copying and the cutover. You approve it in writing, and no live copy starts until the approved plan matches what is set up.
- A dry run reads Google and Microsoft 365 and writes nothing. Its report counts what would copy and lists each exception it finds, such as an item that cannot move, with the reason. You approve it in writing before the live run.
- Each Gmail mailbox is measured against the space in its Microsoft 365 mailbox before any mail moves. If the mail will not fit, that mailbox does not start. Its report shows where the space goes, by folder and label, in sizes and counts only. Mail goes into the main mailbox rather than the archive, so the fix is to trim mail in Gmail, move to a license with a larger mailbox, or agree in writing to move only mail newer than a chosen date.
- For files, a setup script your SharePoint administrator runs creates a SharePoint site for each shared drive by default, adds eligible members by role, and requests a OneDrive for each person whose files move. A check then confirms every one of those OneDrives is ready before any file copies.
- Your administrators grant access without creating a key file. In Microsoft 365, a Global Administrator grants admin consent. In Google, an administrator adds the app's client ID (its identifier) under domain-wide delegation, limited to the agreed scopes (the kinds of data it may reach).
A proof batch first
A few of your people move first: their mail, calendars and contacts, and their My Drive files if you want them included. They open everything in your own Microsoft 365 and check it. Anything they flag is worked through, and the full move waits for your written go-ahead.
Where MigrationSanity goes further than Microsoft's own tools
- Who runs the move
- Microsoft's own tools, by defaultYour Exchange administrator (Microsoft Learn)
- MigrationSanityRun for you. A few of your people move first, and you check them before the full move
- Google access for mail
- Microsoft's own tools, by defaultA Google Cloud project, a service account and a service key, created in your Google account (Microsoft Learn)
- MigrationSanityOne client ID added under domain-wide delegation. No Google Cloud project, service account or key is created in your Google account
The Microsoft column describes each tool's documented default. The MigrationSanity column and this section follow the How it works page and the Known Limitations documents each client receives. Known Google limitations summarizes those documents.
Vendor pages checked October 2026. Microsoft and Google change their plans and admin screens often, and the linked pages are the reference.