This is the complete onboarding task flow for exporting either regular mailboxes or in-place archive mailboxes from Exchange Online to PST (Outlook Data Fil) files.
For this scenario, the Destination is a Bring Your Own storage container on Azure. This will hold all of the PST files after the mailboxes have been exported to PST. The export of the selected mailboxes will be saved, in the Azure container, as one or more PST files per user mailbox. BitTitan Azure Storage is only available as a Source endpoint for PST migration.
A new PST will be created for every 10GB of data in a mailbox. This increases the export speed and leads to efficiency improvements.
First migration?
We’ve created a guide on scoping, planning, and managing the migration process for your use. If this is your first migration, we recommend reading this guide carefully.
MigrationWiz
MigrationWiz is a migration tool, not a syncing tool. If changes are made at the source after migration, they will not sync to the destination, nor will changes made at the destination sync to the source. We do not have “live” monitoring of changes (as with a sync agent) and we cannot handle scenarios such as conflict resolution without user interaction.
MigrationWiz supports the capability to share migration projects across a Workgroup. When the Project Sharing feature is turned on, all Agents besides those who are Inactive can view all migrations projects.
Prerequisites
Licensing
Purchase and apply User Migration Bundle licenses for all the users being migrated. For this migration type, we suggest the User Migration Bundle. For questions on licensing, visit Which Migration License Do I Need?.
- User Migration Bundle Licenses have unlimited data available per license.
- User Migration Bundle Licenses are applied to the customer's users and expire 12 months after their purchase date.
- Document and Personal Archive projects are all included when using User Migration Bundle Licenses.
- This license type must be applied manually.
To use your license by following the next steps:
- Review Considerations.
- Purchase Licenses.
- Create a Customer.
- Apply Licenses.
Licenses are released once payment has been received:
- Licenses are available immediately upon payment if you purchase via credit card.
- If you purchase via wire transfer (100+ licenses), the licenses will be available once payment is received and accepted.
- We do not accept purchase orders because of processing overhead.
In both cases, you will be notified by email that payment has been accepted and licenses are available in your account upon notification.
For more information on licensing, including coupon redemption and other licensing types, see our Which License Do I Need? guide.
Purchase licenses by following the steps below:
- Sign in to your BitTitan account.
- In the top navigation bar, click Purchase.
- Click the Select button and choose User Migration Bundle licenses.
- Enter the number of licenses you want to purchase. Click Buy Now.
- Enter a Billing address if applicable.
- Click Next.
- Review the Order Summary and enter a payment method.
- Click Place Your Order.
Create Customer on MSPComplete by performing these steps:
- Click the Add button in the top navigation bar
- Click the Add Customer button on the All Customers page
- Select the appropriate workgroup in the left navigation pane and click All Customers.
- Click Add Customer.
- Enter the new customer’s information in the Add Customer form. Primary Email Domain and Company Name are required. The rest are optional.
- Click Save.
- Repeat steps 1 through 4 for each customer you want to add.
Perform these steps on MSPComplete:
-
Select the correct workgroup on the top of the left navigation pane.
Important
This is the workgroup which the customer and migration projects were created under. Your account must be part of the workgroup if the project was not created under your account. - Click Customers on the left navigation pane.
- Click the customer that employs the user to whom you want to use the User Migration Bundle license.
- Click the Users tab at the top of the page.
- Apply the license to the users by checking the box to the left of their emails.
-
Click the Apply User Migration Bundle License button
at the top of the page.
Tip
We recommend adding users to the Customer page with the vanity domain. Then apply the User Migration Bundle Licenses, before editing to show the .onmicrosoft domain, if the .onmicrosoft domain will be used for the migration. -
Click Confirm if at least one unassigned User
Migration Bundle license is available for each selected user.
Important
If there are no User Migration Bundle licenses currently available to be assigned and your role in the workgroup is Manager or higher, the form that appears provides all the necessary information and will walk you through the steps of purchasing User Migration Bundle licenses.
Limitations
Please review the following limitations before performing this type of migration.
- We are not able to support migrations with two-factor or multifactor authentication.
Prepare the Source Environment
Retirement of Exchange Web Services in Exchange Online
Microsoft has announced that Exchange Web Services (EWS) requests will start to be blocked in M365 tenants with a phased, admin controllable disablement beginning on October 1, 2026, and a final retirement date of April 1, 2027. We recommend reviewing the information outlined in Microsoft’s announcement for additional details.
We are taking the necessary steps to transition to Microsoft Graph API and ensure continued service without disruption. The transition to Microsoft Graph API will be completed before the final retirement date of EWS.
All migrations using EWS for Exchange Online (Microsoft 365) endpoints require following the steps under the Enable EWS Access in Exchange Online and Scoping EWS Access Before Retirement using EWSAllowedAppIDs sections of the migration guide for your particular migration scenario before you start your migration. These steps are required if your source, destination or both are Exchange Online (Microsoft 365).
Important
If you receive the following type of error in your project "Your migration failed while checking credentials. The request failed. The remote server returned an error: (403) Forbidden" check that you follow the steps correctly for Enabling EWS and adding your MigrationWiz EWS AppID to the EWSAllowedAppIDs list in your tenant using the steps below.
All PowerShell steps below use ExchangeOnline PowerShell and require a Global Admin to run the commands.
Enable EWS (Exchange Web Services) Access in Exchange Online
EWS access will be blocked if the following steps are not completed:
- Enable EWS at Organization level
- Enable EWS at User level
- Add the EWS Application using the tenant to the EWSAllowedAppIDs list (see steps below)
Ensure that the commands and steps below are followed to enable EWS in your tenant and prevent any unintentional interruptions to your migrations. For further information regarding this topic, please review the following Microsoft article. If you need assistance on this topic, please contact BitTitan's support team.
Commands to Enable EWS at Organization-level:
# Check current status:
Get-OrganizationConfig | fl EWSEnabled
# Enable EWS:
Set-OrganizationConfig -EWSEnabled $true
Commands to Enable EWS at User-level:
# Check a specific mailbox
Get-CASMailbox -Identity user@domain.com | fl EWSEnabled
# Enable EWS for a specific mailbox
Set-CASMailbox -Identity user@domain.com -EWSEnabled $true
# Enable EWS for ALL mailboxes (use with caution)
Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox -EWSEnabled $true
Scoping EWS Application Access Before Retirement using EWSAllowedAppIDs
Important
You must complete the Modern Authentication app registration steps outlined in the Authentication Methods for Microsoft 365 (All Products) Migrations article before running the commands below. The Application (client) ID generated during that process is the App ID you will add to the allow list using the steps below.
In preparation for EWS retirement, Microsoft has introduced EWSAllowedAppIDs, a tenant-level allow list that restricts EWS access to only the applications you explicitly approve. To ensure MigrationWiz continues operating without interruption, the steps below are required as of August 6, 2026. Starting October 1, 2026, Microsoft will block all EWS traffic for tenants where EWSEnabled is set to True at Organization-level and User-level, but no EWSAllowedAppIDs list has been configured. Only applications whose App IDs appear in the EWSAllowedAppIDs list will be permitted to use EWS with MigrationWiz.
For further information on EWSAllowedAppIDs, review Microsoft's article Introducing EWSAllowedAppIDs: Preparing for the Final Phase of EWS Retirement.
Important Considerations Before Running any Commands
- Changes to the allow list can take up to 24 hours to take effect. Exchange Online servers refresh their in-memory cache once every 24 hours. Plan accordingly and add your App IDs for your migration well ahead of time before testing your App IDs or starting your migration.
- Verify after every change. Run the verify command after any add or remove operation to confirm the list is correct before assuming the change took effect.
Verify the Allow List:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Note
The -RetrieveEwsOperationAccessPolicy parameter is required. The allow list is not returned by a standard Get-OrganizationConfig call.
Warning
Always run the above command first, before creating or modifying the Allow List to ensure there is not an existing list already. If you perform the steps for creating the Initial Allow List on an existing list, you may erase the App IDs already in that list. If you verify that the list already exists with App IDs, move down to the Add an App ID to an Existing List step.
If a pre-existing list of EWS App IDs are present, make sure you copy or safely store those IDs before making any modifications to the EWSAllowedAppIDs list in the case you need to re-apply the App IDs.
Create the Initial Allow List:
If no allow list exists yet, create one by specifying one or more of the MigrationWiz EWS App IDs in a comma-separated string. This replaces any existing value, so include all App IDs you want to permit in a single command.
Set-OrganizationConfig -EwsAllowedAppIDs "11111111-2222-3333-4444-555555555555,aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
Verify the Allow List:
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
Important
Always verify the Allow List before and after making any modifications to your List.
If you need to add or remove an App ID for an already existing list, you must read the current list, compute the updated list, and then write the full value back using the Microsoft provided PowerShell commands below:
Add an App ID to an Existing List:
For $newAppId, use the App ID of the MigrationWiz EWS application for the project ("" included).
# Read the current allow list
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)
# Define the new App ID to add
$newAppId = "99999999-8888-7777-6666-555555555555"
# Combine existing and new values
$updated = @($current, $newAppId)
# Write the updated allow list back
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")
Remove an App ID from an Existing List:
For $removeAppId, use the App ID of the MigrationWiz EWS application for the project ("" included).
# Read the current allow list
$current = (Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Select-Object -ExpandProperty EwsAllowedAppIDs)
# Define the App ID to remove
$removeAppId = "99999999-8888-7777-6666-555555555555"
# Split the comma-separated list into individual App IDs
$appIds = $current -split ","
# Remove the specified App ID
$updated = $appIds | Where-Object { $_ -ne $removeAppId }
# Write the updated allow list back
Set-OrganizationConfig -EwsAllowedAppIDs ($updated -join ",")
Modern Authentication Requirements
The steps listed in the Required Permission for Performing M365 Mailbox and Archive Migrations article apply to both the source and destination tenant when they are Exchange Online, in regards to Exchange Web Services (EWS) in the mailbox and archive mailbox. Use a Global Administrator for the configuration steps.
Please review the documentation before preparing the source.
Create a Migration Service Account
Create a migration service account in Microsoft 365 for the tenant, this account does not require any admin role assigned. However, it must have full access to the user mailboxes or have the required API Permissions.
We recommend adding the necessary API permissions to the Modern Authentication app you are using for your O365 mailbox or archive mailbox endpoint. You can follow the steps outlined in this guide, as this is BitTitan's recommended approach.
Deprecation of Microsoft Application Impersonation Role
From February 2025, Microsoft has started the depreciation process to remove the Application Impersonation role from O365. Exchange On-premise and hosted Exchange are not affected by these changes. For further information please see this article.
If you are currently using Application Impersonation for your migrations, there is no telling when that will eventually fail. It is highly recommended that you switch to using the new API permission process to avoid delays in your project due to permission failures.
Set up Accounts in Microsoft 365
Set up accounts on Microsoft 365 and assign licenses. These can be created in several ways:
- Manually, one at a time.
- By bulk import, via CSV file.
- By PowerShell script.
Prepare the Tenant to Send & Receive Large Items
We do not impose any limit on item/attachment sizes. However, large items/attachments can fail to migrate because of external factors. There are two considerations:
What is the maximum attachment size allowed by the Destination system?
- Most email systems impose size limits. For example, if the Destination system has a 30MB limit, any item/attachment larger than 30MB will fail to migrate.
What is the connection timeout for the Source and Destination system?
- For security reasons, most email systems close opened connections after a predetermined amount of time. For example, if the Destination system only has 512Kbps of network bandwidth and closes connections after 30 seconds, we may be unable to transfer large items/attachments before the connection is closed.
MigrationWiz automatically makes multiple attempts to migrate large items. Upon completion of a migration, you may resubmit it in error retry mode to try to migrate failed items. This is always free of charge.
When migrating from or to Office 365 use the steps provided here to increase the Max Send and Max Recieve quotas, Change message size limits in Office 365.
Discover PST Files and Upload to Azure
Discover PST files on the network, and upload them into Azure.
- Discover PST files and upload them to Azure via UploaderWiz in PST Discovery Mode
-
Discover PST files and upload them to Azure via a Group Policy Object?
Important
Each PST file that will be migrated must be equal to or less than 10GB. PST files that are larger than 10GB must be divided into separate files that are each smaller than the 10GB limit. Otherwise, the migration will fail.
- Password-protected PSTs cannot be migrated while protected. Remove the password from any protected PSTs before migration. After migration, re-apply the passwords to protect the documents.
Prepare the Destination Environment
- Estimate Azure storage costs. This step is optional but is useful in providing the customer with upfront storage costs ahead of time.
- Buy an Azure subscription, or use the free one-month trial (option only viable for very small migration).
- Create an Azure storage account:
- Visit the Azure portal.
- Click Storage accounts.
- Click Create.
- Select the Subscription and create a new Resource group or use a current one.
- Name the Storage account.
- For Region, select a geographic region for the storage account.
- For Performance, select Standard general-purpose V2 account.
- In the Redundancy field, select Locally-redundant storage (LRS).
- Click the Review button.
- When the validation ends, click the Create button.
- Once the deployment of the storage account is complete, click the Go to resource button or open up the home page for the new storage account.
- In the Security + networking section of the left sidebar, click on Access Keys.
- On a notepad, copy the Storage account name and the key1 and save them.
- Create an Azure BLOB container. Take note of the name of the BLOB to be entered in the Bucket Name field in the project Advanced Options.
MigrationWiz Steps
Create a Mailbox Migration Project
Create the Mailbox Migration project or Archive Migration project (depending on whether you are exporting regular or in-place archive mailboxes to PST). Read the How do I create a new migration project? article for more information.
- Create the Mailbox Migration Project or In-Place Archive Project
-
Select the customer, or create a new one.
Important
If you are migrating a mixture of regular mailboxes and in-place archive mailboxes, create one mailbox migration project and one archive project.
- Create source and destination endpoints.
Endpoints
Endpoints are created through MigrationWiz. If you select an existing endpoint from the dropdown, it will only show ten endpoints. If you have more than ten, you may need to search it.
Consider that endpoint search is case and character-specific. For example, Cust0mer will not show up if the search is customer. We recommend keeping a list of endpoints you have created, along with any unique spellings or capitalization you may have used.
Create your Endpoints
Please review the following tabs to create your destination and source endpoints.
Create the Source and Destination endpoints.
Create your source endpoint by following the next steps:
- Click Source Settings.
- Select New.
- Enter endpoint name.
- For the endpoint type, select Microsoft 365.
- Enter the administrator username and password in the proper fields.
- Click Add Endpoint.
- Complete the Application (client) ID, the Directory (tenant) ID, and the Client Secret fields.
- Click Next Step.
Create your destination endpoint by following the next steps:
- Click Destination Settings.
- Select New.
- Enter endpoint name.
- For endpoint type, select PST.
- Enter the Storage Account Name.
-
Enter the Access Key.
Important
Only numbers and lowercase letters are allowed for the Azure Storage Account Name for the destination endpoint. If you enter an upper case letter, your migration will fail.
- Select the Region closest to your Destination Tenant from the dropdown menu.
- Click Save Project.
Region of Destination Tenant
The Region of Destination Tenant feature optimizes the migration performance and speed by choosing the region closest to the destination tenant. MigrationWiz displays a dropdown that allows you to select the destination region when configuring your destination endpoint.
Tip
You can find the region of your destination tenant directly in the Microsoft Entra admin center by going to Identity > Overview > Properties, and using the Country or region or the Data location.
For more information on this topic, review this article.
Warning
If you do not complete this field you will not be able to save your project and the “This field cannot be left blank.” error will appear.
Add Accounts
Using Bulk Add, add the accounts, also referred to as "items", that will be migrated to the project:
- Sign in to your MigrationWiz account.
- Select the Project for which you want to perform the bulk import.
- Click Add.
- Click Bulk Add.
- Follow the instructions on the page.
Please consider the following information when adding your accounts.
- The Source will be the SMTP address for each mailbox.
- The Destination will be the name that you want for the PST file. It must include .pst at the end of each entry. A good format to follow is to name each file after the username that the PST file will belong to, e.g., user1.pst, user2.pst.
Advanced Options
The following advanced options show you some options that will help you to perform o complete a migration.
Source/Destination Tab
-
Bucket Name = migrationwiz
- This field can be left as it is if you did not create your own Azure container when preparing your Destination environment. The PST files will be exported to a container named "migrationwiz".
- If you created an Azure container with a different name, this entry must be changed to match the name of your container.
Run Verify Credentials
- Open the Project containing items you wish to validate.
- Select the items you wish to validate.
- Click on the Start button in your dashboard.
- Select Verify Credentials from the drop-down list.
Once complete, the results of the verification will be shown in the Status section.
Start migration
- Select the users.
- Click the Start button from the top.
- Select Full Migration.
- Click Start Migration.
Run Retry Errors
Look through the user list and click any red "failed migration" errors. Review the information and act accordingly.
If problems persist, contact Support.
Post Migration
Optional (does not apply to Microsoft storage): Delete the Azure blob container that was created during the upload to Azure. This will prevent incurring post-migration Azure costs for these containers. Be careful to only delete the container that was created for this migration project.