This article will guide you through the steps for migrating mailboxes from On-Premises Exchange 2003 servers to Microsoft 365. This task flow will not work for Exchange 2007+ or Hosted Exchange. For those workflows, refer to the Exchange Migration Guides list.

There are some tools and resources that will make the migration easier.

MigrationWiz

MigrationWiz is a migration tool, not a syncing tool. If changes are made at the source after migration, they will not sync to the destination, nor will changes made at the destination sync to the source. We do not have “live” monitoring of changes (as with a sync agent) and we cannot handle scenarios such as conflict resolution without user interaction.

MigrationWiz supports the capability to share migration projects across a Workgroup. When the Project Sharing feature is turned on, all Agents besides those who are Inactive can view all migrations projects. 

First Migration?

We have created a guide on scoping, planning, and managing the migration process for your use. If this is your first migration, we recommend reading this guide carefully.

Prerequisites

Please consider the information below before choosing this migration type.

Licensing

We recommend that you purchase User Migration Bundle licenses for this migration scenario. User Migration Bundle licenses allow the performance of multiple migrations with a single license. For questions on licensing, visit MigrationWiz Licenses.

Use your license by following the next steps:

1. Purchase Licenses.
2. Create a Customer.
3. Apply Licenses.
4. Review Considerations.

Limitations

Please consider the following limitations when performing a migration.

• We are not able to support migrations with two-factor or multifactor authentication. 
• The maximum size of individual files that can be migrated is 60GB.
• App passwords are not supported for the Microsoft 365 endpoint. 

Migrated Items

Please click the bars below to check the migrated and non-migrated items. We are constantly working to create a better migration experience for you so these items may change over time.

Exchange questions and troubleshooting

Our Exchange Mailbox FAQ, Exchange Migration Setup and Planning, and Exchange Mailbox Migration Troubleshooting guides contain many common questions and concerns, along with more information, guidance, and steps to resolve issues such as throttling.

Prepare the Source Environment

Set Up Admin Account

To create an administrator account (e.g., MigrationWiz), perform the following steps when logged into the Exchange Server.

1. Open the System Manager.
2. Expand the Recipient Configuration node.
3. Right-click on the Mailbox node.
4. Click on New Mailbox.
5. Click on Next.
6. Click on Next.
7. Enter "MigrationWiz" as the first name.
8. Enter "MigrationWiz" as the user logon name, and optionally select a user principal name (UPN) domain.
9. Enter a password and confirm the password.
10. Click on Next.
11. Click on Browse to select a Mailbox database.
12. Click on Next.
13. Click on New.
14. Click on Finish.

OWA

If you have not already done so, set up router ports for OWA traffic, by following the steps in the Prerequisites section of this article. Set different OWA URLs for each environment and configure router ports to accept inbound/outbound mail traffic for those OWA URLs.

If you have followed through all the prerequisite steps of this guide, this step will already have been completed.

Test Mailbox Access

To test mailbox access on the Exchange Server 2003, perform the following: 

1. Open the browser to https://mail.example.com/exchange  
   • Ideally, we recommend opening this URL from a non-domain-joined machine on a different network than the Exchange Server. 
   • com is the DNS name of the OWA server. 
2. When prompted for credentials, enter the username and password of the account to be used to access the mailbox. 
   • This can be either the credentials of the end user mailbox itself or administrative credentials.
   • To migrate using administrative credentials, enter administrative credentials into OWA. 
   • The Inbox of the end user's mailbox or administrator's mailbox should be visible once logged in. 
3. If using administrative credentials, change the URL to  https://mail.example.com/exchange/user@example.com
   • user@example.com is the primary SMTP address of the mailbox being accessed. 
   • The result is that the Inbox of the mailbox user@example.com should be visible. 

Configure the Exchange Authentication Method

To configure the Exchange authentication method:

1. Open the Exchange System Manager.
2. Go to Server > Protocols > HTTP > Exchange Virtual Server.
3. Right-click on the Exchange node and select Properties.
4. Click on the Access tab.
5. Click on the Authentication button.
6. Make sure Basic Authentication is selected as the only authentication mode, and a single backslash (\) is specified for the Default domain.
7. Click on OK.
8. Click on OK.
9. For the Public node, repeat Steps 3-8.

Make sure that the settings are identical in IIS:

1. Open the Internet Information Services (IIS) Manager.
2. Go to Server > Web Sites > Default Web Site (or the website node that contains your Exchange virtual directories).
3. Right-click on Exchange in the navigation tree on the left, and select Properties.
4. Click the Directory Security tab.
5. Click the Edit button within the Authentication and Access Control section.
6. Make sure Basic Authentication is selected as the only authentication mode, and a single backslash (\) is specified for the Default domain.
7. Click on OK.
8. Click on OK.
9. For the Public node, repeat Steps 3-8.

Make sure to back out any .config file so that you can easily go back to the previous state.

Increase MAPI-named Property Limits

1. Start the Registry Editor on the mailbox server.
2. Locate the following registry key:
   • HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\<ServerName>\<Private-GUID>
3. Set the following DWORD values or create new values if they do not exist.
   • NonMAPI Named Props Quota == 00007fff
   • Named Props Quota == 00007fff

You may either wait approximately 30 minutes for these values to take effect automatically, or reboot the server to take effect immediately.

These instructions have also been documented on the Microsoft website.

Prepare the Destination Environment

Modern Authentication Requirements

The steps listed in the Required Permission for Performing M365 Mailbox and Archive Migrations article apply to both the source and destination tenant when they are Exchange Online, in regards to Exchange Web Services (EWS) in the mailbox, and archive mailbox. Use a Global Administrator for the configuration steps.

Please review the documentation before preparing the source.

Create an Administrator Account

Create an administrator account in Microsoft 365 to be used for migration or use the global admin account for the tenant. The administrator account must have full access to the user mailboxes, have the required API Permissions, or be granted impersonation rights.

We recommend adding the necessary API permissions to the Modern Authentication app you are using for your O365 mailbox or archive mailbox endpoint. You can follow the steps outlined in this guide, as this is BitTitan's recommended approach.

However, you can still use the BitTitan impersonation approach if you already have a service account with the Application Impersonation role already assigned. Microsoft is phasing out RBAC Application Impersonation in Exchange Online and no longer allows the assignment of this role to new accounts.

Set Up Accounts in Microsoft 365

Set up accounts on Microsoft 365 and assign licenses. These can be created in several ways:

• Manually, one at a time.
• By bulk import, via CSV file. 
• By PowerShell script. 

Prepare the Tenant to Send & Receive Large Items

We do not impose any limit on item/attachment sizes. However, large items/attachments can fail to migrate because of external factors.  There are two considerations:​

MigrationWiz Steps

Create a Mailbox Migration project

1. Click the Go to My Projects button.
2. Click the Create Project button.
3. Click on the type of project that you wish to create. For this migration:
   • Mailbox: Mailbox projects are used to migrate the contents of the primary user mailbox from the previous environment to the new environment. Most mailbox migrations can migrate email, calendars, and contacts.

     Important

     For mailbox migrations, use administrative credentials to access mailboxes. In most migration scenarios, the admin account needs to have full access rights to the Source mailboxes.
4. Click Next Step.
5. Enter a Project name and select a Customer.
6. Click Next Step.
7. Select or create your endpoints
8. Click Next Step.
9. Click Save and Go to Summary.

Endpoints

Endpoints are created through MigrationWiz. If you select an existing endpoint from the dropdown, it will only show ten endpoints. If you have more than ten, you may need to search it.

Consider that endpoint search is case and character-specific. For example, Cust0mer will not show up if the search is customer. We recommend keeping a list of endpoints you have created, along with any unique spellings or capitalization you may have used.

Create your Endpoints

Please review the following tabs to create your destination and source endpoints.

Application (client) ID, Directory (tenant) ID, and Client Secret

For Microsoft 365 Mailbox and Archive migrations, MigrationWiz adds the Application (client) ID, Directory (tenant) ID, and Client Secret fields.

While the Application (client) ID and the Directory (tenant) ID are mandatory, the Client Secret field is not. It will depend on the permissions of the user account that performs the migration. Please review the following information before the creation of your M365 endpoints.

• The client secret value is not mandatory if you use delegated permissions. Please leave the Client Secret field empty.

• The client secret value is mandatory if you use the Application Impersonation using API Permissions approach.

• If you already have an admin account with the Impersonation role enabled (not using the Application Impersonation using API Permissions approach) the client secret value is not mandatory. Please leave the Client Secret field empty.

For more information about how to get the Application (client) ID and Directory (tenant) ID values from the Application Registration, please review step 3 of this article.

Region of Destination Tenant

MigrationWiz displays a dropdown to select the Preferred Region of the Tenant at the destination endpoint. This value updates the Preferred Region of the Destination Tenant field in the project's Advanced Options, and vice versa. You will notice that both values are always the same.

The Region of Destination Tenant feature optimizes the migration performance and speed when choosing the region closest to the destination tenant.

Endpoint Validation

Once the information has been provided for both, the source and destination endpoint, and the customer selects Save and Go to Summary, MigrationWiz performs an endpoint validation check.

This validation tests the administrator credentials entered into the project and the Modern Authentication setup only. If there is an issue, the screen redirects to the endpoint and provides an error message or flyout that can be selected for more information regarding the error.

Common Errors when Configuring Your Endpoint

For more information on the AADSTS700016, AADSTS90002, and ADDSTS50126 issues review the Common Errors Using Modern Authentication page.

Add Users

Add the user accounts that will be migrated to the project. MigrationWiz allows you to bulk import mailboxes into the system. Bulk Add uses a CSV containing the source and destination email addresses for the users to add the users to the project.

To import one or more mailboxes:

1. Sign in to your MigrationWiz account.
2. Select the Project for which you want to perform the bulk import.
3. Click Add.
4. Click Bulk Add.
5. Follow the instructions on the page.

Advanced Options

The following advanced options may be useful for your migration. 

Support Tab

Default Options for Microsoft 365 Endpoints

By default, some fields are view-only. In other words, you cannot edit or remove them from the support options page. To edit them, you need to edit the source or destination endpoint of your project.

Among these default options, you can find ModernAuthClientIdExport, ModernAuthTenantIdExport, ModernAuthClientSecretExport, ModernAuthClientIdImport, ModernAuthTenantIdImport, and ModernAuthClientSecretImport. 

The support options above are required when configuring your endpoint.

Source/Destination Tab

Set to use impersonation at Destination. Check the Use impersonation at Destination box. 

Run Verify Credentials

1. ​Sign in to your MigrationWiz account​.
2. Open the Project containing items you wish to validate.
3. Select the items you wish to validate.
4. Click on the Start button in your dashboard.
5. Select Verify Credentials from the drop-down list.

Once complete, the verification results will be shown in the Status section.​ 

Notify Users

Notify users that a migration is occurring. Send an email to all users telling them the time and date of the migration.

Run Migration

Pre-Stage pass

1. Select the users to migrate.
2. Click the Start button from the top.
3. Select Pre-Stage Migration.
4. Under the Migration Scheduling section, select 90 days ago from the drop-down list.
5. Click Start Migration.

MX Record Cutover

Change over MX records on the DNS provider's portal.

Also, include the AutoDiscover (CName) setting.

• Set up mail forwarding. 
• Set up mail routing on Microsoft 365.

Full (Delta) pass

1. Select the users to migrate.
2. Click the Start button from the top.
3. Select Full Migration.
4. Click Start Migration.

Run Retry Errors

Look through the user list and click any red "failed migration" errors. Review the information and act accordingly.

If problems persist contact Support.

Request Statistics

Click the pie chart icon in the MigrationWiz dashboard to receive an email containing all the project migration statistics.

Related Topics

• EWS isn't supported when accessing Teams data 
• Retirement of RBAC Application Impersonation in Exchange Online
• Authentication Methods for Microsoft 365 (All Products) Migrations
  • Required Permissions for Performing M365 Mailbox and Archive Migrations 
  • Scoping Requirements for M365 Mailbox and Archive Migrations
• BitTitan - Data Security and Privacy Policy