How to migrate email from Microsoft 365 to Google Workspace

Moving email from Microsoft 365 to Google Workspace means copying mailbox data with Google's import tool and moving mail routing without bouncing anything in between. This guide follows Google's and Microsoft's documentation at the time of writing (October 2026): the exact Admin console path, the Exchange Online settings that catch people out, and the DNS changes in a safe order.

What does Google's Exchange Online import move?

Google's data import for Exchange Online copies email, calendar events, contacts and Microsoft To Do tasks from Microsoft 365 into Google Workspace accounts. Google's help page says "the import doesn't delete or modify a user's data in Exchange Online," so the source stays intact (Google Workspace Admin Help).

Google lists what does and doesn't come across on a separate page, What's imported in an Exchange Online import?:

Google offers two methods. The default method uses Google's shared API quota and needs no Azure setup. The advanced method uses "your own dedicated API quota" and needs an Azure application in your Microsoft tenant, and it's the one that brings over rules, In-Place Archives and calendar permissions.

What do you need to prepare first?

1. Create every user in Google Workspace. Google says the tool "only copies users with existing Exchange Online and Workspace accounts". Match each Google address to the Microsoft 365 address where you can.
2. Verify your domain in Google and keep Gmail's MX switch for later. Don't touch MX yet.
3. Check your roles. You must be a Google super administrator, and you'll sign in to Microsoft 365 as a Global Administrator to connect.
4. Decide on shared mailboxes. Google imports a shared mailbox mapped to a group as a Collaborative Inbox, or one mapped to a user account as a normal mailbox.
5. List everything that sends through Microsoft 365: copiers, apps using SMTP AUTH, connectors, and Teams or SharePoint notifications. Each needs a new path through Google. Google Workspace's SMTP relay service is one option for devices.
6. Copy your current DNS records (MX, SPF, DKIM, DMARC, autodiscover) as your rollback plan.

How do you run the import in the Google Admin console?

Google's steps, at the time of writing (October 2026), are:

1. In the Google Admin console, go to Menu > Data > Data import & export > Data import.
2. For Exchange Online, click Import.
3. Click Connect and sign in to your Microsoft 365 account as a Global Administrator. When connected, Data Import appears as an authorized API client on Google's Domain-wide delegation page.
4. Select users. With 20 or fewer users, review the suggested mappings and click Save Changes. With more, upload a CSV with the headers Source Exchange Email and Target GUser. Google allows up to 1,000 users per import.
5. Configure settings (optional). Choose the data types, a Date range start date, Include deleted email, Include spam email, and Exclude specific folders.
6. Start the import and watch its progress.
7. Run a delta import after cutover to copy new or changed items.
8. Exit the import when finished. Google then deletes the client ID and removes Data Import from domain-wide delegation.

Example CSV for more than 20 users:

Source Exchange Email,Target GUser
anna@example.com,anna@example.com
sales@example.com,sales-team@example.com

Two warnings from Google's page. Contacts duplicate if you run a second full import: "A new import duplicates any contacts you already imported." And don't run a delta import after editing the Target GUser column; exit and start a new import instead. If you must import the same data twice, uncheck Copy additional calendars to avoid duplicate secondary calendars.

How do you keep mail flowing during the move?

For most small organizations, the simplest plan is a single cutover: import the bulk of the data, switch MX in one evening, then run a delta import. If you need to move people in waves, use a routing subdomain, the same pattern Microsoft uses for migrations in the other direction:

1. In Google, add a user alias domain such as g.example.com under Menu > Account > Domains > Manage domains > Add a domain, and give it Google's MX record.
2. When a user moves, forward their Microsoft 365 mailbox to user@g.example.com. In the Exchange admin center, go to Recipients > Mailboxes, select the user, then Manage email forwarding and turn on Forward all emails sent to this mailbox (off by default). In PowerShell: Set-Mailbox -Identity anna@example.com -ForwardingSmtpAddress anna@g.example.com -DeliverToMailboxAndForward $false.
3. Check the outbound spam policy. Microsoft's default automatic forwarding setting, Automatic - System-controlled, has meant Off since 2021 for new organizations and for existing ones that weren't actively using it (Microsoft Learn). If forwarding is blocked, senders get 5.7.520 Access denied. Allow it only for migrating users, in a custom policy.
4. Once everyone has moved, switch MX to Google and remove the forwarding.

The accepted domain catch

While your Microsoft 365 tenant still holds the domain, it is usually an Authoritative accepted domain, the type Microsoft says you typically use when all recipients are in Microsoft 365. Microsoft defines it as: "Email is delivered to email addresses that are listed for recipients in Microsoft 365 or Office 365 for this domain" (Microsoft Learn). So mail sent from inside the tenant, by a user who hasn't moved yet, an app or a Teams notification, goes to the old Exchange mailbox, whatever your MX says.

Fix it before cutover by forwarding each moved mailbox (above), or by removing the old mailboxes once their data is imported. If the tenant keeps some users, use the Internal relay domain type, which Microsoft says relays mail for recipients it doesn't know to your other mail system, plus an outbound connector to Google; you change it under Mail flow > Accepted domains or with Set-AcceptedDomain -Identity example.com -DomainType InternalRelay. Our guides to authoritative vs internal relay domains and Microsoft 365 connectors cover both settings.

Which DNS records change at cutover?

Make these changes in order, using the values the Google Admin console shows for your domain.

• SPF. Google's SPF page gives v=spf1 include:_spf.google.com ~all for domains that send only through Google. Keep one record listing both providers during the overlap, never two records. Check it with the SPF Checker, and see multiple SPF records for why two records fail.
• DKIM. In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Authenticate email, generate a key (2048-bit if your DNS host supports it; the default selector is google), publish the TXT record, then click Start authentication (Google Workspace Admin Help). Google says that after you turn on Gmail you "must wait 24–72 hours" before you can get your DKIM key, so start early. If your DNS host splits long records, see 2048-bit DKIM records.
• MX. Google's MX page gives one record: name @, priority 1, value smtp.google.com. It says to "remove any other MX records" and that "it can take up to 72 hours for the new MX records to be recognized." Lower the TTL a day ahead and follow our MX change checklist.
• DMARC stays the same. Watch DMARC reports for a week so Google shows up as a passing source.

If a spam filter sits in front of Microsoft 365

If your MX points at a filtering service, MX doesn't change. Set up Google's inbound gateway for the filter's IP addresses, then change the filter's delivery destination from Microsoft 365 to Google. Our Google Workspace inbound gateway guide covers each setting, including the option that rejects mail not sent through the gateway.

What should you check after cutover?

1. Inbound: send from two or three outside providers and confirm the messages land in Gmail. Read the headers in the Email Header Analyzer.
2. Outbound: confirm SPF, DKIM and DMARC pass on mail sent from Gmail. Our guide to checking authentication results shows where to look.
3. Delta import: run it once mail stops reaching Microsoft 365, then exit the import.
4. Devices and apps: remove Microsoft 365 accounts from phones and Outlook, and repoint copiers and apps that sent through Exchange Online.
5. Security settings: rebuild spam, phishing and attachment protections in Gmail. Start with Gmail spam settings for Google Workspace.
6. Microsoft 365: keep licenses until the final import has finished and nothing new arrives there. Retain or export anything your retention policy requires.

Next steps

• Save your current records with the free Email Health Check before you start, as your rollback plan.
• Going the other way? See migrating from Google Workspace to Microsoft 365.
• Run a test import for one or two users and check what arrived against Google's "what's imported" list.
• If you want filtering and outage spooling in front of Gmail after the move, see how iBlockSpam works with Google Workspace, or follow the guided migration plan.

Browse our other migration guides.