SharePoint migration checklist and pre-migration assessment
A phase-by-phase checklist from discovery to sign-off, with the exact assessment findings that block or slow a SharePoint Online migration.
A SharePoint migration checklist is only useful if it is specific about what to check. Generic lists tell you to “assess your content”; this one tells you which findings stop an import, which ones slow it down, which permissions the tool needs and when, and what to have in hand before you tell anyone a date. It is organised by phase, with a table per phase you can copy into your own plan, and it applies whether the source is a file server, SharePoint Online or another tenant.
The limits quoted are Microsoft's published SharePoint Online limits and Migration API guidance; the assessment findings are the ones ShareShift's assessor reports, which map to the same limits.
Phase 1: discovery
| Check | Why |
|---|---|
| Inventory every source: file shares by UNC path, SharePoint sites and subsites, libraries and lists, OneDrive accounts, teams with private channels, Planner plans | Scope drives everything else; the workloads that get forgotten are lists, private channels and Planner |
| Total bytes and item counts per source, largest files, deepest paths | Microsoft's throughput bands are per tenant: roughly 10 TB a day light, 1 TB a day medium, 250 GB a day heavy, no SLA |
| Owners for each source, and who signs off | Verification needs someone who knows the content |
| Users and groups referenced in permissions, including disabled and departed accounts and orphaned SIDs | The Migration API needs UPN logins and substitutes the System Account for anyone unresolved |
| Whether anything over 100 TB will move within 30 days | That volume needs a support request from the tenant administrator in advance |
| Sensitivity labels, retention policies and legal holds in play | Microsoft advises removing labels before native cross-tenant moves; holds affect what can be deleted afterwards |
Phase 2: the pre-migration assessment
Run the assessment against the destination path, because the path limit is measured there, and run it before designing the destination so the design can fix the findings. It needs no destination connection. These are the findings and what each means.
| Finding | Rule | Severity |
|---|---|---|
| Path too long | Decoded destination URL path over 400 characters | Blocker |
| Invalid character | Any of " * : < > ? / \ | in a name | Blocker |
| Leading or trailing space or period | Not allowed at the start (space) or end (space or period) of a name | Blocker |
| Reserved name | .lock, CON, PRN, AUX, NUL, COM0 to COM9, LPT0 to LPT9, desktop.ini, thumbs.db, any _vti_ segment, a folder named forms at library root | Blocker |
| File too large | Over 250 GB | Blocker |
| Library item limit | More than 30 million items in one library | Blocker |
| Large file | Over 15 GB, the figure in Microsoft's content package guidance | Warning |
| Blocked or unwanted type | .pst, .ost, .lnk, .tmp | Warning |
| OneNote | .one and .onetoc2 need the whole notebook folder migrated intact | Warning |
| View threshold | A folder with more than 5,000 direct children | Warning |
| Office lock file | ~$ prefix, skipped | Warning |
| Hidden or zero-byte file | Migrates fine; listed for completeness | Info |
For SharePoint sources add: files with more than 5,000 versions, lists projected over the 5,000-item view threshold, unique permission scope counts, checked-out files, unsupported list templates such as discussion boards, classic pages, and managed metadata columns whose term sets do not exist at the destination. For Teams add shared channels, which cannot be migrated, and for Planner the count of tasks whose assignees will not map. The file share guide and the lists and content types article explain each in depth.
Phase 3: destination design and mapping
| Check | Detail |
|---|---|
| Destination structure decided | Which shares and sites become which sites and libraries; landing folders created beforehand, because the Migration API never creates them |
| Deep trees and large folders | Flatten paths that would exceed 400 characters; split folders over 5,000 children |
| User mapping CSV | Source UPN to destination UPN; domain rewrites for suffix-only changes; a fallback user for the unresolved; every mapped user verified at the destination |
| Permission mapping | NTFS rights or source permission levels to destination levels; a decision on Deny entries; flatten wherever ACLs below a point are the same |
| Content types and columns | Confirm site columns keep their GUID and content types keep their id; confirm term sets exist for managed metadata columns |
| Conflict rule for incremental passes | Source wins, skip if destination newer, destination wins, or always copy |
| What is deliberately left behind | PSTs, blocked types, classic pages, shared channels; written down and agreed |
Phase 4: access, permissions and the worker
Migration traffic must be app-only. Microsoft's guidance is to use only app-based authentication because user mode triggers increased throttling, and a certificate credential is throttled less than a secret. This phase is where projects lose a week to consent and propagation, so do it early.
- One app registration per tenant involved, with a certificate credential and admin consent for application permissions: SharePoint
Sites.FullControl.All(the Migration API needs it when permissions are copied;Sites.ReadWrite.Allis not enough) andUser.Read.Allfor OneDrive; GraphSites.FullControl.AllandUser.Read.All; the Teams roles includingTeamwork.Migrate.Allif channels are in scope;Tasks.ReadWrite.Allfor Planner. - Allow about five minutes after consent before tokens include the roles, and test sign-in before scheduling anything.
- Check whether the tenant needs the Teams protected APIs form approved for
ChannelMessage.Read.All; it varies by tenant. - A worker machine with outbound HTTPS to
*.sharepoint.com,graph.microsoft.comandlogin.microsoftonline.com, sitting where it can read the sources. Workers share the tenant's API budget, so add them for bandwidth and reach, not for budget; see the throttling article. - Where the PFX and the migration state live, and who can read them. The state file is the source of truth for resume and incremental passes; back it up.
Phase 5: pilot, bulk pass and incremental passes
| Check | Detail |
|---|---|
| Pilot on representative content | One site or share, a few OneDrive accounts, one team with a private channel, one plan. Owners check dates, authors, versions, permissions and Teams history in the destination |
| Schedule windows agreed | Nights and weekends in the destination tenant's region; Microsoft applies tighter limits to background apps during weekday daytime |
| Throughput caps set | Packages in flight, upload rate, requests per minute, so the migration coexists with a busy tenant |
| Bulk pass running while the source stays live | Nobody stops working; incremental passes catch the changes |
| Retry policy understood | Items Microsoft reports as failed are retried automatically; permanent failures are listed with Microsoft's message |
| Pause and resume tested | Stop a run after the current package and resume it; confirm nothing completed is re-sent. See pause and resume |
| Incremental passes scheduled up to cutover | Unchanged items skipped; changed files added as new versions with metadata restored |
Phase 6: cutover, verification and sign-off
| Check | Detail |
|---|---|
| Source made read-only | Then a final incremental pass, then redirect users |
| Teams migration completed | Channels and teams taken out of migration mode; members added afterwards, because a team in migration mode rejects membership changes |
| Counts reconciled | Item-level report against the assessment baseline, per library and per list; not-migrated counts for list item version history reviewed |
| Failures decided | Every permanent failure has an owner and a decision |
| Completion record exported | Item-level CSV, JSON summary and the HTML completion report, plus Microsoft's per-job import logs; see reports and completion certificate |
| Audit trail retained | Microsoft 365 audit log records migration file events since November 2024; keep the tool's audit export alongside |
| App registrations removed | Deleting the registration revokes every permission and certificate at once; the migrated content and reports are unaffected |
| Source retention agreed | Keep the old share or site read-only for an agreed period before deletion |
A checklist is also a buying guide in disguise. Every row above is something a tool either does for you, reports to you, or leaves to you. The best migration tools roundup applies the same criteria across the market, and ShareShift's pricing page covers the plans and the 30-day trial, which is long enough to run phases 2 to 5 on real content before committing.
Frequently asked questions
What should a pre-migration assessment check for SharePoint Online?
Destination paths over 400 characters, invalid characters, leading or trailing spaces and periods, reserved names, files over 250 GB, folders over the 5,000-item view threshold, libraries over 30 million items, blocked file types, OneNote notebooks, unique permission scopes, unresolved users, files with more than 5,000 versions, unsupported list templates and classic pages.
Can the assessment run without a destination?
Yes. It needs the intended destination path to measure path length, but no destination connection. That means you can assess and design before any tenant permissions are granted.
Which permissions does a SharePoint migration tool need?
Application permissions with a certificate credential: SharePoint Sites.FullControl.All and User.Read.All, Graph Sites.FullControl.All and User.Read.All, the Teams roles including Teamwork.Migrate.All for channel history, and Tasks.ReadWrite.All for Planner. Admin consent takes about five minutes to reach tokens.
How long should we plan for?
From Microsoft's per-tenant bands with no SLA: roughly 10 TB a day for light content, 1 TB a day for medium content such as Office files, 250 GB a day for heavy content, off-peak. Incremental passes mean the cutover itself is short even when the bulk pass takes weeks.
Run your first migration on a 30-day free trial
Every workload, unlimited data, three workers, pause and resume built in. Worker-only, so your content never passes through our servers. The trial key is issued from the portal and works with the same app you would buy.