Microsoft 365 migrations have one extra wrinkle Gmail doesn't: your business domain is usually pointed at Exchange, so the cutover has to be planned rather than clicked. Here's how to do it without a gap in delivery.
Two different migrations
Which path you follow depends on what you have:
- A personal Outlook.com / Hotmail / Live account — this works like any consumer migration: import over IMAP, forward the old address, done.
- Microsoft 365 with your own domain — your domain's MX records point at Microsoft. The mailbox import is the easy half; the MX cutover is the part to plan.
Personal Outlook.com accounts
Outlook.com supports IMAP without any admin setup. In Tobava Mail, open Settings → Migration and choose Outlook / Office 365:
- Server:
outlook.office365.com - Port:
993(SSL/TLS) - Username: your full Outlook address
- Password: an app password if you have two-step verification on (Microsoft account → Security → Advanced security options → App passwords)
Then set up forwarding in Outlook.com under Settings → Mail → Forwarding, and work through your important accounts as described in our Gmail migration guide.
Microsoft 365 with a business domain
Step 1: Inventory before you touch anything
List every mailbox, shared mailbox, distribution list and alias in the tenant. Microsoft 365 Admin Center → Users → Active users and Teams & groups → Shared mailboxes. Shared mailboxes are the ones most often forgotten — they hold years of accounts@, info@ and support@ history.
Step 2: Create the matching accounts in Tobava Mail
Add your domain in Tobava Mail first, then create one account per mailbox using the same local part (sarah@, accounts@, and so on). Matching addresses exactly means nothing in the import has to be re-mapped later. Note that role addresses such as accounts@ need their own account today — there is no shared-mailbox delegation, so plan who holds each one.
Step 3: Import each mailbox over IMAP
Microsoft 365 mailboxes are reachable over IMAP at outlook.office365.com:993. Two things to know:
- Modern authentication may block basic IMAP sign-in on a hardened tenant. If the import rejects valid credentials, an admin can temporarily enable authenticated SMTP/IMAP for the affected mailboxes in the Microsoft 365 Admin Center, or you can export to PST and import that instead.
- Per-user app passwords are needed for any mailbox with MFA enabled — which should be all of them.
Run the imports *before* the MX cutover, not after. Mail keeps flowing to Microsoft the entire time, so a slow import costs you nothing and you can verify content landed correctly before anything changes publicly.
Step 4: Lower your DNS TTL — 48 hours ahead
This is the step that makes a cutover clean. In your DNS provider, drop the TTL on your MX records to 300 seconds at least 48 hours before the switch. Resolvers worldwide will then pick up the new records within minutes instead of hours.
Step 5: Cut over MX, SPF, DKIM and DMARC together
On cutover day, update all four in one sitting:
- MX → Tobava Mail's mail exchangers (shown in your admin panel)
- SPF → replace Microsoft's
include:spf.protection.outlook.comwith Tobava's include; don't leave both unless you're deliberately running split delivery - DKIM → publish the DKIM TXT record exactly as shown in your Tobava Mail domain settings, using the selector given there
- DMARC → keep your existing policy, but start at
p=nonefor a week if you've never had one, then tighten
If any of those four are new to you, our SPF, DKIM and DMARC explainer breaks down what each one actually does.
Step 6: Keep the old tenant alive for 30 days
Don't cancel the Microsoft subscription the day you cut over. Keep it running for a month so that:
- Anything delivered to Exchange during DNS propagation is still retrievable
- You can run a final delta import to catch messages that arrived mid-migration
- A rollback is still one DNS change away if something unexpected surfaces
Step 7: Verify before you call it done
Send test mail in both directions, and check a received message's headers show spf=pass, dkim=pass and dmarc=pass. Gmail's Show original view is the fastest way to read this.
What about Teams, SharePoint and OneDrive?
Tobava Mail includes an equivalent set in the same account: Docs, Sheets and Slides for documents, encrypted Drive for file storage, Meet for video calls, plus Calendar and Chat. Export SharePoint/OneDrive content as normal files and upload to Drive — no proprietary format lock-in on our side.
Try Tobava Mail free
Encrypted email, a private inbox, and a full workspace — built by a cybersecurity company. No ads, no tracking, no message scanning.
Create your free account