1

Cutover Migration Guide Step by Step

Version 1.0

Contents
Step 1: Get started with an Exchange cutover migration ............................................................................. 1
Step 2: Add your domain .............................................................................................................................. 2
Step 3: Prepare your environment ............................................................................................................... 4
Step 4: Connect Office 365 to your email system ........................................................................................ 6
Step 5: Migrate your mailboxes .................................................................................................................... 7
Step 6: Create mail-enabled user mailboxes ................................................................................................ 9
Step 7: Reduce mail delays ......................................................................................................................... 10
Step 8: Route mail to Office 365 ................................................................................................................. 11
Step 9: Assign Licenses ................................................................................................................................ 13
Step 10: Delete migration batch ................................................................................................................. 13
Step 11: Create Autodiscover record .......................................................................................................... 14
Step 12: Decommission Exchange Servers.................................................................................................. 14
Step 13: Install Office .................................................................................................................................. 15
Step 14: Help everyone get started ............................................................................................................ 16

Step 1: Get started with an Exchange cutover migration

When you perform an Exchange cutover migration, Office 365 uses the address book on your on-
premises Exchange server to create new Office 365 mailboxes. It then migrates email messages,
contacts, and calendar items from each on-premises mailbox to the corresponding Office 365
mailbox.

Unlike an Exchange staged migration, a cutover migration moves your entire on-premises Exchange
organization to Office 365 over a few days.

Want help from Office 365 experts?

Microsoft FastTrack for Office 365 has experts available to help you set up Office 365. Our FastTrack
Center team will work with your organization to fix any blocking issues and help you set up your
email and other Office 365 services. Learn more here.

Overview of cutover migration tasks

 2

Here are the tasks involved in an Exchange cutover migration to Office 365.

1. Get familiar with the cutover migration steps.

2. Add your domain to Office 365.
3. Prepare your on-premises environment.
4. Connect Office 365 to your email system.
5. Create a cutover migration batch and migrate mailboxes.
6. Convert on-premises mailboxes to mail-enabled users.
7. Configure DNS to reduce email delivery delays.
8. Route your email directly to Office 365.
9. Assign Office 365 licenses to your users.
10. Delete the cutover migration batch.
11. Create an Autodiscover record.
12. Decommission your Exchange servers.
13. Help users install the latest version of Office on their computers.
14. Provide users with the information they need to start using Office 365.

Step 2: Add your domain

Office 365 includes a setup wizard that walks you through the steps of adding your domain to Office
365 and verifying that you own it.

To add your domain

1. Sign in to the Office 365 admin center and, in the left-hand navigation, click Domains.
2. On the Manage domains page, click Add domain to launch the setup wizard.

3. Click Let's get started.

 3

4. Type the domain name you own and want to use with Office 365 and click Next.

5. Now follow the instructions to add a TXT record to your DNS hosting provider. Adding the TXT
record is how Office 365 verifies you own the domain.
Note. Only add the TXT record at this time. You will change your MX record later in the setup
process.

Note: The setup wizard typically detects your domain's DNS host and provides step-by-step
instructions for adding the TXT record. If it is unable to detect your DNS host, see Create DNS
records for Office 365 when you manage your DNS records for instructions for adding DNS records
at various DNS hosting providers.
6. After you've added the record at your DNS host, finish this step by clicking Okay, I've added the
record.
7. On the next page, if you were able to add your TXT record, the setup wizard informs you that your
domain has been verified. At this point you exit the setup wizard by clicking the X in the upper right
hand corner of the page.
 4

Important! If you continue in the setup wizard it can help you add users to Office 365. However, for
a cutover migration, we use another method to do that. Do not use the wizard to add any users you
want to migrate as part of your cutover migration.

Step 3: Prepare your environment

After adding your domain to Office 365, you need to prepare your on-premises Exchange
environment for your cutover migration.

To prepare for a cutover migration

1. Configure Outlook Anywhere on your on-premises Exchange Server. The email migration service
uses Outlook Anywhere (also known as RPC over HTTPs) to connect to your on-premises Exchange
Server. Outlook Anywhere is automatically configured for Exchange 2013. For information about how
to set up Outlook Anywhere for Exchange 2010, Exchange 2007, and Exchange 2003, see the
following:

 Exchange 2010: Enable Outlook Anywhere

 Exchange 2007: How to Enable Outlook Anywhere
 How to configure Outlook Anywhere with Exchange 2003

You have to use a certificate that is issued by a trusted certification authority (CA) with Outlook
Anywhere. It won't work with a self-signed certificate. For more information, see How to configure
SSL for Outlook Anywhere.

2. Add Outlook Anywhere and Autodiscover to certificate. You must use a certificate issued by a
trusted certification authority (CA) with your Outlook Anywhere configuration in order for Office 365
to run a cutover migration. For cutover migration, you need to add the Outlook Anywhere and
 5

Autodiscover services to your certificate. For instructions on how to set up certificates, see the
following:

 Add an SSL certificate to Exchange 2013

 Add an SSL certificate to Exchange 2010
 Add an SSL certificate to Exchange 2007

3. Optional: Verify that you can connect to your Exchange organization using
OutlookAnywhere.Try one of the following methods to test your connection settings.

 Use Outlook from outside your corporate network to connect to your on-premises Exchange
mailbox.
 Use the Microsoft Exchange Remote Connectivity Analyzer to test your connection settings. Select
the Office 365 tab and use the Outlook Connectivity test.

4. Set permissions. The on-premises user account that you use to connect to your on-premises
Exchange organization (also called the migration administrator) must have the necessary permissions
to access the on-premises mailboxes that you want to migrate to Office 365. This user account is
used when you connect Office 365 to your email system later in this procedure.
To migrate the mailboxes, the migration administrator must be assigned one of the following
permissions:

 FullAccess permission for each on-premises mailbox or …

 Receive As permission on the on-premises mailbox database that stores user mailboxes.

For instructions about how to set these permissions, see Assign permissions to migrate mailboxes to
Exchange Online.

5. Disable Unified Messaging (UM). If UM is turned on for the on-premises mailboxes you're
migrating, turn off UM before migration. Turn on UM for the mailboxes after migration is complete.
For how-to steps, see How to Disable Unified Messaging for a User in Exchange 2007.

6. Create security groups. Because the email migration service can't detect whether on-premises
Active Directory groups are security groups, it can't provision any migrated groups as security groups
in Office 365. If you want to have security groups in Office 365, you must first provision an empty
mail-enabled security group in Office 365 before starting the cutover migration. To create a mail-
enabled security group, seeGroups in Exchange Online and SharePoint Online.

7. Clean up delegates. A cutover migration only moves mailboxes, mail users, mail contacts, and mail-
enabled groups. If any other Active Directory object, such as user mailbox that is not migrated to
Office 365 is assigned as a manager or delegate to an object being migrated, you must remove them
from the object before migration.
 6

Step 4: Connect Office 365 to your email system

Now you set up the connection between your Exchange email system and Office 365. For a cutover
migration, this means creating an Outlook Anywhere migration endpoint. A migration endpoint
contains the settings and credentials needed to connect your on-premises server that hosts the
mailboxes you're migrating with Office 365. The migration endpoint also defines the number of
mailboxes to migrate simultaneously.

To create a migration endpoint

1. In the Office 365 admin center, in the lower left-hand navigation, expand ADMIN and then
click Exchange. This will open the Exchange admin center.

2. In the Exchange admin center, go to recipients and then migration.

3. Choose ... (More) and then Migration endpoints.

4. On the migration endpoints page, choose + (New).

5. On the Select the migration endpoint type page, choose Outlook Anywhere and then Next.
6. On the Enter on-premises account credentials page, enter information in the following boxes:
 Email address. Type the email address of any user in the on-premises Exchange organization that
will be migrated. Office 365 will test the connectivity to this user's mailbox.
 Account with privileges. Type the user name (domain\user name format or an email address) for
an account that has the necessary administrative permissions in the on-premises
organization.Office 365 will use this account to detect the migration endpoint and to test the
permissions assigned to this account by attempting to access the mailbox with the specified email
address.
 7

 Password of account with privileges. Type the password for the account with privileges that is
the administrator account.
7. Choose Next and do one of the following:
 If Office 365 successfully connects to the source server, the connection settings are displayed in
the Confirm the migration endpoint page. Choose Next.

 If the test connection to the source server is not successful, provide the following information:
 Exchange server. Type the fully qualified domain name (FQDN) for the on-premises Exchange
server that host the mailboxes that you are migrating.. or example, EXCH-SRV-
01.corp.contoso.com.
 RPC proxy server. Type the FQDN for the RPC proxy server for Outlook Anywhere. Typically,
the proxy server is the same as your Outlook Web App URL. For example, mail.contoso.com,
which is also the URL for the proxy server that Outlook uses to connect to an Exchange Server.
8. On the Enter general information page, type a migration endpoint name (for example, Test5-
endpoint). Leave the other two boxes blank to use the default values.

9. Choose New to create the migration endpoint.

Step 5: Migrate your mailboxes

Create and run a migration batch

After you create your Outlook Anywhere migration endpoint, you create and run a migration batch
 8

to migrate mailboxes to Office 365. A migration batch is a collection of on-premises mailboxes you
want to move.

To create the cutover migration batch

In a cutover migration, on-premises mailboxes are migrated to Office 365 in a single migration batch.
Here are the steps to create the batch.

1. In the Office 365 admin center, in the left side navigation, expand Admin and then clickExchange.
This opens the Exchange admin center.
2. In the Exchange admin center, go to recipients > migration.
3. Choose New + > Migrate to Exchange Online.

4. On the Select a migration type page, choose Cutover migration > Next.
Note: If the cutover option is grayed out so that you can't select it, it usually means directory
synchronization has been activated for your organization. If DirSync is enabled, then a cutover
migration is not an option. A staged migration can be used instead.

5. On the Confirm the migration endpoint page, the migration endpoint information is listed. Verify
the information and then choose Next.

6. On the Move configuration page, type the name (without spaces or special characters) of the
migration batch, and then choose Next. The batch name is displayed in the list of migration batches
on the Migration page after you create the migration batch.
 9

7. On the Start the batch page, choose one of the following:

 Automatically start the batch. The migration batch is started as soon as you save the new
migration batch with a status of Syncing.
 Manually start the batch later. The migration batch is created but is not started. The status of
the batch is set to Created. To start a migration batch, select it on the migration dashboard, and
then choose Start.
8. Choose new to create the migration batch. The new migration batch is displayed on the migration
dashboard.

To start the cutover migration batch

Here's how you started your migration batch if you configured it to be started manually.

1. In the Exchange admin center, go to recipients > migration.

2. On the migration dashboard, select the batch and then choose Start.
3. If a migration batch starts successfully, its status on the migration dashboard changes to Syncing.

To verify the synchronization worked

You'll be able to follow the sync status on the migration dashboard. If there are errors, you can view
a log file that gives you more information about them. You can also verify that the users get created
in the Office 365 admin center as the migration proceeds.
After the migration is done, the sync status is synced.

Step 6: Create mail-enabled user mailboxes

Convert on-premises mailboxes to mail-enabled users
At this point in the cutover migration, your migration batch has finished running. You've also verified
that all mailboxes in the batch are successfully migrated and the initial synchronization of mailbox
items to Office 365 is complete.

We now recommend that you convert the on-premises mailboxes in the migration batch to mail-
enabled users. Why? After an Exchange cutover migration, a user has an on-premises mailbox and an
Exchange Online mailbox in Office 365. Because mail sent to the user’s on-premises mailbox is
 10

forwarded to their Exchange Online mailbox after migration, users need to connect to their Exchange
Online mailboxes to access their email. But if a person uses Outlook to open their mailbox, the
Autodiscover service still tries to connect to the on-premises mailbox. After you convert on-premises
mailboxes to mail-enabled users, the Autodiscover service uses a mail-enabled user to connect
Outlook to the Exchange Online mailbox after the user creates a new Outlook profile.

Another important reason to convert on-premises mailboxes to mail-enabled users is to retain proxy
addresses from the Exchange Online mailboxes by copying proxy addresses to the mail-enabled
users. This lets you manage cloud-based users from your on-premises organization by using Active
Directory. Also, if you decide to decommission your on-premises Exchange organization after all
mailboxes are migrated to Exchange Online, the proxy addresses you've copied to the mail-enabled
users will remain in your on-premises Active Directory.

For Windows PowerShell scripts that you can download and run to convert on-premises mailboxes to
mail-enabled users, see the following:

 Convert Exchange 2007 mailboxes to mail-enabled users

You can use the scripts available here to convert Exchange 2007, Exchange 2010, and Exchange
2013 mailboxes to mail-enabled users.

 Convert Exchange 2003 mailboxes to mail-enabled users

You can use the scripts available here to convert Exchange 2003 mailboxes to mail-enabled users.

Step 7: Reduce mail delays

Optional: Reduce email delays
This task is optional, but it can help avoid delays in the receiving email in your new Office 365
mailboxes.

When people outside of your organization send you email, their email systems don’t double-check
where to send that email every time. Instead, their systems save the location of your email system
based on a setting in your DNS server known as a time-to-live (TTL). If you change the location of
your email system before the TTL expires, the sender's email system tries to send email to the old
location before figuring out that the location changed. This location change can result in a mail
delivery delay. One way to avoid this is to lower the TTL that your DNS server gives to servers outside
of your organization. This will make the other organizations refresh the location of your email system
more often.

Most email systems ask for an update each hour if a short interval such as 3,600 seconds (one hour)
is set. We recommend that you set the interval at least this low before you start the email migration.
Setting the interval as low as 300 seconds (5 minutes) is OK. This setting allows all the systems that
send you email enough time to process the change. Then, when you make the final switch over to
Office 365, you can change the TTL back to a longer interval.
 11

The place to change the TTL setting is on your email system’s MX record. This record lives on your
public-facing DNS system. If you have more than one MX record, you need to change the value on
each record to 3,600 seconds or less.

If you need some help configuring your DNS settings, see Create DNS records for Office 365 when
you manage your DNS records

Step 8: Route mail to Office 365

Route your email directly to Office 365
You want to update (or add) two important DNS records to make sure mail properly flows to and
from Office 365. These are your MX record and SPF record.

 MX record. Email systems use an MX record to figure out where to deliver emails. Now that your
email migration to Office 365 is complete, it’s time to change your MX record to make sure that
email is delivered to your Office 365 mailboxes instead of your former mail system. For the
company contoso.com., an MX record that's been updated to point to Office 365 would look like
this: contoso-com.mail.protection.outlook.com
 SPF record. An SPF records is a TXT record that ensures only the organization that owns a
domain is actually sending email from that domain. It helps prevent somebody from using your
domain to send spam. Because Office 365 is sending all your messages, you'll only list Office 365
as a valid sender for your domain. The SPF record for an organization’s domain that uses Office
365 to send all their mail should look like this: v=spf1 include:spf.protection.outlook.com -all

Your MX and SPF record changes are made at your DNS hosting provider, also known as a domain
host. The Office 365 admin center will guide you through the process.

For more about Office 365 mail routing, see Mail flow best practices for Exchange Online and Office
365.

To update your MX and SPF records

1. Open the Office 365 admin center.
2. Click Domains to open the Manage domains page.
3. Select your domain and then choose Fix issues.
The Action column shows Fix issues because we asked you to stop the wizard partway through so
you could migrate your email to Office 365 before switching your MX record.
 12

4. Based on your domain host, you'll see one of two options for adding the MX record:
 If your domain host is GoDaddy, the DNS records you need to add - including MX and SPF
records - are displayed on a page. Click the Add the recordsbutton at the bottom of the page to
have Office 365 automatically fix the MX and other DNS records for your domain.
 If you have a different domain host than GoDaddy, the DNS records you need to add - including
MX and SPF records - are displayed on a page. For each record, choose What do I fix? and follow
the step-by-step instructions to update the record.

Note. For instructions for changing an MX record at specific DNS hosts, seeCreate DNS records
for Office 365 when you manage your DNS records. If your DNS provider isn't included, or if you
want to get a sense of the general directions, general MX record instructions are available
at Create DNS records at any DNS hosting provider for Office 365.

5. After you've added all the records, you'll see a message that your domain is set up correctly and that
no action is required.
 13

It can take up to 72 hours for the email systems of your customers and partners to recognize the
changed MX record. We recommend you wait at least 72 hours before you stop Office 365
synchronization with your source system.

Step 9: Assign Licenses

Assign licenses to Office 365 users
Another task to complete after moving user mailboxes to Office 365 is to activate Office 365 user
accounts by assigning licenses. If you don't assign a license, the mailbox is disabled when the grace
period ends (30 days).

To assign a license in the Office 365 admin center, see Assign or remove licenses, or view a list of
unlicensed users.

Step 10: Delete migration batch

Delete the cutover migration batch
After you change the MX record and verify that all email is being routed to Office 365 mailboxes,
notify your users that their mail is going to Office 365.

After users have been notified, you can delete the cutover migration batch. However, be sure to
verify the following before you do:

 All users have started using and receiving mail in their Office 365 mailboxes.After the batch
is deleted, mail sent to mailboxes on the on-premises Exchange Server isn't copied to the
corresponding Office 365 mailboxes.
 Office 365 mailboxes were synchronized at least once after mail began being sent directly
to them. To do this, make sure that the value in the Last Synced Time box for the migration
batch is more recent than when mail started being routed directly to Office 365 mailboxes.

When you delete a cutover migration batch, the migration service cleans up any records related to
the migration batch and then deletes the migration batch. The batch is removed from the list of
migration batches on the migration dashboard.

To delete the cutover migration batch

1. In the Exchange admin center, go to recipients > migration.
2. On the migration dashboard, select the batch, and then choose Delete.
Note: It can take a few minutes for the batch to be removed.
3. In the Exchange admin center, again go to recipients > migration.
4. Verify that the migration batch is no longer listed on the migration dashboard.
 14

Step 11: Create Autodiscover record

Create an Autodiscover DNS record
After all on-premises mailboxes are migrated to Office 365, you can configure an Autodiscover DNS
record for Office 365 to enable users to easily connect to their new Office 365 mailboxes with
Outlook and mobile clients. This new Autodiscover DNS record must use the same namespace that
you're using for your Office 365 organization. For example, if your Office 365 namespace is
contoso.com, the Autodiscover DNS record you need to create is autodiscover.contoso.com.

If you choose to keep your Exchange Server instead of decommission it, you should also make sure
that the Autodiscover DNS CNAME record points to Office 365 in both internal and external DNS
after the migration so that the Outlook client will to connect to the correct mailbox.

In Exchange 2007, Exchange 2010, and Exchange 2013 you should also set Set-ClientAccessServer
AutodiscoverInternalConnectionURI to null using the Exchange Management Shell. For example: set-
clientAccessServer -autodiscoverInternalConnectionUri $null.

Office 365 uses a CNAME record to implement the Autodiscover service for Outlook and mobile
clients. The Autodiscover CNAME record must contain the following information:

 Alias: autodiscover
 Target: autodiscover.outlook.com

To configure an Autodiscover record

For specific instructions on how to configure the Autodiscover record at various DNS hosting
providers, see Create DNS records for Office 365 when you manage your DNS records. If your DNS
provider is not listed, see Create DNS records at any DNS hosting provider for Office 365.

Step 12: Decommission Exchange Servers

Decommission on-premises Exchange Servers
After you've verified that all email is being routed directly to the Office 365 mailboxes, and no longer
need to maintain your on-premises email organization or don't plan on implementing a single sign-
on solution, you can uninstall Exchange from your servers and remove your on-premises Exchange
organization.

For more information, see the following:

 Modify or Remove Exchange 2010

 How to Remove an Exchange 2007 Organization
 How to Uninstall Exchange Server 2003
 15

Note: Decommissioning Exchange can have unintended consequences. Before decommissioning

your on-premises Exchange organization, we recommend that you contact Microsoft Support.

Step 13: Install Office

Help users install Office on their computers
Each Office 365 user may install Office 365 ProPlus on their computers if your organization has a
qualifying Office 365 subscription. Office 365 ProPlus has the latest versions of Word, PowerPoint,
Excel, Outlook, OneNote, Publisher, and Access, and also includes Skype for Business, InfoPath, and
OneDrive for Business.
We encourage users to install Office using the Office 2013 Installation Wizard as soon as they're able
to sign in to their Office 365 accounts. Users will be prompted for their Office 365 sign in credentials,
and the installer will then run readiness checks on their PC to ensure there is enough free hard drive
space.

When using the Office 2013 Installation Wizard, the installation files are streamed from the Internet.
If you have a large number of users simultaneously installing Office it can create Internet bandwidth
traffic jams, so plan accordingly.

To install Office on a Windows 7 or higher computer

1. Go to the Office 2013 Installation Wizard.

2. Sign in with your Office 365 credentials.
The Office installer will run readiness checks to ensure the computer meets the system requirements
for Office 365 ProPlus.
3. In the installation page, click Install.
 16

Note. Office installation files are streamed from the Internet. If you have a large number of users
simultaneously performing the Office installations, you may experience bandwidth issues, so plan
accordingly.

To use other options to install Office

 For Windows computers or Macs that cannot use the above installation link, follow the directions
here.
 For administrators who prefer to use different methods to deploy the Office 365 ProPlus suite to
their end users, such as System Center Configuration Manager,please review this link.

Step 14: Help everyone get started

Help your users get started with Office 365
With your Exchange cutover migration complete, it's important that users in your organization
understand how to be productive with Office 365. As the admin, you're responsible for making sure
everyone has their sign-in information and knows how to get started with Office 365.

To help people get started with Office 365

Your users may want to use the web-based versions of their Office 365 apps when signing in from
home or temporary computers.

 How to sign in to Office 365 for business

Many users will want Office 365 on their mobile phone or tablet.

 Set up a mobile device using Office 365 for business

And finally, here are few training resources that can help your Office 365 users achieve more.

 Learn your way around Office 365 for business

 Office training and tutorials
 Office 365 Learning Center