Skip to content

Microsoft 365 / Exchange Online to Zimbra Migration

This guide walks through moving mailboxes from Microsoft 365 (Exchange Online) to InteSys Zimbra while preserving folder structure, rules, categories, calendars, contacts, and shared mailboxes — all with zero downtime.

Step 1: Prerequisites

  • Global administrator access to the Microsoft 365 tenant (admin.microsoft.com).
  • Entra ID access (formerly Azure AD) to create the migration application.
  • List of mailboxes to migrate: primary, shared, rooms, and resources.
  • DNS access for the domain, required for the final cutover.
  • InteSys Zimbra hosting already provisioned — see the Hosting Setup Guide.

Recommended window

Plan for 3 to 7 business days. Mailboxes larger than 50 GB or with more than 10 years of history may require extended windows due to EWS/Graph throttling.

Step 2: Inventory of Volume, Mailboxes, and Resources

From the Exchange admin center (admin.exchange.microsoft.com), export:

  • Primary mailboxes with size and item count.
  • Shared mailboxes — these migrate to Zimbra without requiring a license on the destination, which often cuts costs.
  • Rooms and equipment — these become resource calendars in Zimbra with the same auto-accept rules.
  • Distribution groups and Microsoft 365 groups (the latter require a decision: convert to a distribution group or keep as an external Teams list).

InteSys connects to Microsoft 365 through an Entra ID application with application permissions (Graph + EWS) — no user password is involved.

  1. In entra.microsoft.com, go to Applications > App registrations > New registration.
  2. Suggested name: InteSys Migration.
  3. Under API permissions, add the following application permissions (not delegated):
    • Mail.Read (Microsoft Graph)
    • Calendars.Read
    • Contacts.Read
    • full_access_as_app (Office 365 Exchange Online / EWS)
  4. Click Grant admin consent.
  5. Send InteSys the Application (client) ID, the Directory (tenant) ID, and the generated client secret.

Modern Auth required

Microsoft has disabled Basic Auth in Exchange Online. Migration is only possible through OAuth 2.0 / Modern Auth using the Entra ID application — which is why the admin consent step is mandatory.

Step 4: Provisioning the Zimbra Destination

In the InteSys Customer Portal, go to Services > Email Hosting:

  1. Import the CSV from the inventory, mapping primary mailboxes, shared mailboxes, rooms, and resources.
  2. For shared mailboxes, enable the corresponding flag — Zimbra supports them natively without consuming a license.
  3. Recreate distribution groups using the same addresses and members.
  4. Quotas and plans are assigned according to your contract.

Step 5: Parallel Migration via EWS / Graph

The InteSys migration tool copies data in two phases:

  1. Initial pass: full copy of folders, messages, attachments, and metadata (received dates, read flags, categories).
  2. Delta syncs: every 30 minutes, only new messages are copied.

Preserved elements:

  • Folder hierarchy and original names (including folders with Unicode characters).
  • Inbox rules are converted to Zimbra Sieve filters whenever a functional equivalent exists.
  • Outlook categories become Zimbra tags (preserving color when possible).
  • Full history — no date truncation.

Exchange Online throttling

Microsoft 365 enforces throughput limits per tenant and per application. InteSys uses exponential back-off and staggered windows for large mailboxes to avoid blocks. Mailboxes over 100 GB may need to migrate outside business hours.

Step 6: Calendars, Contacts, and Shared Mailboxes

  • Calendars: recurring events, attendees, attachments, and delegation permissions are preserved. Recurring meetings created in Teams migrate as events with an external link (the Teams link remains functional).
  • Contacts and contact lists migrate into the Zimbra address book.
  • GAL (Global Address List) is rebuilt from the tenant directory.
  • Shared mailboxes keep their delegations — if John had read/send access to [email protected], the delegation is recreated in Zimbra.
  • Rooms and resources migrate as resource calendars with the same auto-accept rules.

Step 7: MX and Autodiscover Cutover

On the scheduled day:

  1. T-0: run the final delta sync.
  2. T+5 min: change MX records to mx1.intesys.io and mx2.intesys.io (TTL 300s).
  3. Update Autodiscover — remove the autodiscover.yourdomain.com record pointing to autodiscover.outlook.com and add the InteSys CNAMEs (see DNS Configuration).
  4. SPF: remove include:spf.protection.outlook.com and add include:_spf.intesys.io.
  5. DKIM: publish the InteSys DKIM key (provided in the panel) — the old one can be removed after 48 hours.

Step 8: Post-Migration

Guide your users through the following:

  • Webmail: https://mail.intesys.io.
  • Outlook desktop: remove the Microsoft 365 profile and add the Zimbra account as Exchange ActiveSync (or IMAP+SMTP for lightweight clients). See the ActiveSync Guide for details.
  • Teams/OneDrive/SharePoint: these stay in the Microsoft 365 tenant — only email was migrated. If you plan to migrate collaboration as well, contact InteSys for sizing.
  • Troubleshooting: use the ActiveSync Test if you run into authentication failures on mobile devices.

Keep Microsoft 365 licenses active for at least 30 days after cutover as a safety net.

Ready to move off Microsoft 365 without losing history? InteSys business email plans include free assisted migration — visit the migration hub for details.