# How to migrate email from Microsoft 365 to Google Workspace

URL: https://iblockspam.com/blog/migrate-microsoft-365-to-google-workspace-email
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Switching & migration
Author: iBlockSpam Team

> Move Exchange Online mail to Gmail with Google's data import tool: user mapping, delta imports and what doesn't move, then MX, SPF and DKIM in a safe order.

## Short answer

Create every user in Google Workspace first, then run Google's data import from the Admin console (Data > Data import & export > Data import > Exchange Online) as a super admin, signing in to Microsoft 365 as a Global Administrator. Import mail, calendar and contacts, switch MX to smtp.google.com, update SPF and DKIM, then run a delta import.

Moving email from Microsoft 365 to Google Workspace means copying mailbox data with Google's import tool and moving mail routing without bouncing anything in between. This guide follows Google's and Microsoft's documentation at the time of writing (October 2026): the exact Admin console path, the Exchange Online settings that catch people out, and the DNS changes in a safe order.

## What does Google's Exchange Online import move?

Google's **data import** for Exchange Online copies email, calendar events, contacts and Microsoft To Do tasks from Microsoft 365 into Google Workspace accounts. Google's help page says "the import doesn't delete or modify a user's data in Exchange Online," so the source stays intact ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/migrate/migrate-data-from-an-exchange-online-account)).

Google lists what does and doesn't come across on a separate page, [What's imported in an Exchange Online import?](https://knowledge.workspace.google.com/admin/migrate/whats-migrated-in-an-exchange-online-migration):

| Data | Imported | Not imported (examples Google lists) |
|---|---|---|
| Email | All folders and subfolders, including drafts and sent items; folders become Gmail labels; read status | Messages larger than 150 MB, the Notes folder, categories, flags, pinned status, shared folders |
| Rules | Only with the advanced method and **Import message rules as filters** on | Disabled rules and rules with errors |
| Archive mailboxes | Advanced method only | "The default data import method doesn't support In-Place Archives" |
| Calendar | Primary and additional calendars, attendees, reminders, Teams links (not converted to Meet) | Calendar colors, events before your start date, formatted descriptions, draft events |
| Contacts | Non-deleted contacts, categories as labels | The Global Address List, contact lists, deleted contacts |
| Tasks | To Do personal tasks, up to 100 lists | Recurrence, due times, Planner tasks |

Google offers two methods. The **default method** uses Google's shared API quota and needs no Azure setup. The **advanced method** uses "your own dedicated API quota" and needs an Azure application in your Microsoft tenant, and it's the one that brings over rules, In-Place Archives and calendar permissions.

## What do you need to prepare first?

1. **Create every user in Google Workspace.** Google says the tool "only copies users with existing Exchange Online and Workspace accounts". Match each Google address to the Microsoft 365 address where you can.
2. **Verify your domain in Google** and keep Gmail's MX switch for later. Don't touch MX yet.
3. **Check your roles.** You must be a Google **super administrator**, and you'll sign in to Microsoft 365 as a **Global Administrator** to connect.
4. **Decide on shared mailboxes.** Google imports a shared mailbox mapped to a group as a Collaborative Inbox, or one mapped to a user account as a normal mailbox.
5. **List everything that sends through Microsoft 365**: copiers, apps using SMTP AUTH, connectors, and Teams or SharePoint notifications. Each needs a new path through Google. Google Workspace's SMTP relay service is one option for devices.
6. **Copy your current DNS records** (MX, SPF, DKIM, DMARC, autodiscover) as your rollback plan.

## How do you run the import in the Google Admin console?

Google's steps, at the time of writing (October 2026), are:

1. In the Google Admin console, go to **Menu** > **Data** > **Data import & export** > **Data import**.
2. For **Exchange Online**, click **Import**.
3. Click **Connect** and sign in to your Microsoft 365 account as a Global Administrator. When connected, **Data Import** appears as an authorized API client on Google's Domain-wide delegation page.
4. **Select users.** With 20 or fewer users, review the suggested mappings and click **Save Changes**. With more, upload a CSV with the headers `Source Exchange Email` and `Target GUser`. Google allows up to 1,000 users per import.
5. **Configure settings (optional).** Choose the data types, a **Date range** start date, **Include deleted email**, **Include spam email**, and **Exclude specific folders**.
6. **Start the import** and watch its progress.
7. **Run a delta import** after cutover to copy new or changed items.
8. **Exit the import** when finished. Google then deletes the client ID and removes Data Import from domain-wide delegation.

Example CSV for more than 20 users:

```
Source Exchange Email,Target GUser
anna@example.com,anna@example.com
sales@example.com,sales-team@example.com
```

Two warnings from Google's page. Contacts duplicate if you run a second full import: "A new import duplicates any contacts you already imported." And don't run a delta import after editing the `Target GUser` column; exit and start a new import instead. If you must import the same data twice, uncheck **Copy additional calendars** to avoid duplicate secondary calendars.

## How do you keep mail flowing during the move?

For most small organizations, the simplest plan is a single cutover: import the bulk of the data, switch MX in one evening, then run a delta import. If you need to move people in waves, use a routing subdomain, the same pattern Microsoft uses for migrations in the other direction:

1. In Google, add a user alias domain such as `g.example.com` under **Menu** > **Account** > **Domains** > **Manage domains** > **Add a domain**, and give it Google's MX record.
2. When a user moves, forward their Microsoft 365 mailbox to `user@g.example.com`. In the Exchange admin center, go to **Recipients** > **Mailboxes**, select the user, then **Manage email forwarding** and turn on **Forward all emails sent to this mailbox** (off by default). In PowerShell: `Set-Mailbox -Identity anna@example.com -ForwardingSmtpAddress anna@g.example.com -DeliverToMailboxAndForward $false`.
3. Check the outbound spam policy. Microsoft's default automatic forwarding setting, **Automatic - System-controlled**, has meant **Off** since 2021 for new organizations and for existing ones that weren't actively using it ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)). If forwarding is blocked, senders get [`5.7.520 Access denied`](https://iblockspam.com/smtp-errors/550-5-7-520). Allow it only for migrating users, in a custom policy.
4. Once everyone has moved, switch MX to Google and remove the forwarding.

### The accepted domain catch

While your Microsoft 365 tenant still holds the domain, it is usually an **Authoritative** accepted domain, the type Microsoft says you typically use when all recipients are in Microsoft 365. Microsoft defines it as: "Email is delivered to email addresses that are listed for recipients in Microsoft 365 or Office 365 for this domain" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)). So mail sent from inside the tenant, by a user who hasn't moved yet, an app or a Teams notification, goes to the old Exchange mailbox, whatever your MX says.

Fix it before cutover by forwarding each moved mailbox (above), or by removing the old mailboxes once their data is imported. If the tenant keeps some users, use the **Internal relay** domain type, which Microsoft says relays mail for recipients it doesn't know to your other mail system, plus an outbound connector to Google; you change it under **Mail flow** > **Accepted domains** or with `Set-AcceptedDomain -Identity example.com -DomainType InternalRelay`. Our guides to [authoritative vs internal relay domains](https://iblockspam.com/blog/microsoft-365-accepted-domains-authoritative-internal-relay) and [Microsoft 365 connectors](https://iblockspam.com/blog/microsoft-365-connectors-explained) cover both settings.

## Which DNS records change at cutover?

Make these changes in order, using the values the Google Admin console shows for your domain.

| Order | Record | Microsoft 365 value (example) | Google Workspace value (example) |
|---|---|---|---|
| 1 | SPF (TXT at root) | `v=spf1 include:spf.protection.outlook.com -all` | During overlap: `v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all` |
| 2 | DKIM | `selector1` and `selector2` CNAMEs | `google._domainkey` TXT |
| 3 | MX | `MX 0 example-com.mail.protection.outlook.com.` | `MX 1 smtp.google.com.` |
| 4 | Autodiscover | CNAME to `autodiscover.outlook.com` | Remove once Outlook no longer connects to Microsoft 365 mailboxes |
| 5 | Cleanup | Remove Microsoft's include and DKIM CNAMEs | Final SPF: `v=spf1 include:_spf.google.com ~all` |

- **SPF.** Google's [SPF page](https://knowledge.workspace.google.com/admin/security/set-up-spf) gives `v=spf1 include:_spf.google.com ~all` for domains that send only through Google. Keep one record listing both providers during the overlap, never two records. Check it with the [SPF Checker](https://iblockspam.com/tools/spf-checker), and see [multiple SPF records](https://iblockspam.com/blog/multiple-spf-records-permerror) for why two records fail.
- **DKIM.** In the Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Authenticate email**, generate a key (2048-bit if your DNS host supports it; the default selector is `google`), publish the TXT record, then click **Start authentication** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-dkim)). Google says that after you turn on Gmail you "must wait 24–72 hours" before you can get your DKIM key, so start early. If your DNS host splits long records, see [2048-bit DKIM records](https://iblockspam.com/blog/dkim-2048-bit-key-txt-record-too-long).
- **MX.** Google's [MX page](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) gives one record: name `@`, priority `1`, value `smtp.google.com`. It says to "remove any other MX records" and that "it can take up to 72 hours for the new MX records to be recognized." Lower the TTL a day ahead and follow our [MX change checklist](https://iblockspam.com/blog/change-mx-records-without-losing-email).
- **DMARC** stays the same. Watch [DMARC reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) for a week so Google shows up as a passing source.

### If a spam filter sits in front of Microsoft 365

If your MX points at a filtering service, MX doesn't change. Set up Google's inbound gateway for the filter's IP addresses, then change the filter's delivery destination from Microsoft 365 to Google. Our [Google Workspace inbound gateway guide](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup) covers each setting, including the option that rejects mail not sent through the gateway.

## What should you check after cutover?

1. **Inbound:** send from two or three outside providers and confirm the messages land in Gmail. Read the headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
2. **Outbound:** confirm SPF, DKIM and DMARC pass on mail sent from Gmail. Our guide to [checking authentication results](https://iblockspam.com/blog/check-if-email-passed-spf-dkim-dmarc) shows where to look.
3. **Delta import:** run it once mail stops reaching Microsoft 365, then exit the import.
4. **Devices and apps:** remove Microsoft 365 accounts from phones and Outlook, and repoint copiers and apps that sent through Exchange Online.
5. **Security settings:** rebuild spam, phishing and attachment protections in Gmail. Start with [Gmail spam settings for Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace).
6. **Microsoft 365:** keep licenses until the final import has finished and nothing new arrives there. Retain or export anything your [retention policy](https://iblockspam.com/blog/email-retention-policy-small-business) requires.

## Next steps

- Save your current records with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) before you start, as your rollback plan.
- Going the other way? See [migrating from Google Workspace to Microsoft 365](https://iblockspam.com/blog/migrate-google-workspace-to-microsoft-365-email).
- Run a test import for one or two users and check what arrived against Google's "what's imported" list.
- If you want filtering and outage spooling in front of Gmail after the move, see how iBlockSpam works with [Google Workspace](https://iblockspam.com/platforms/google-workspace), or follow the [guided migration plan](https://iblockspam.com/migrate).

Browse our other [migration guides](https://iblockspam.com/blog/topic/migration).

## Frequently asked questions

### Does Google's Exchange Online import delete mail from Microsoft 365?

No. Google's help page says the import doesn't delete or modify a user's data in Exchange Online; it copies it to the user's Google Workspace account. That makes it safe to run before cutover and again afterward, and to keep Microsoft 365 as a fallback until you're sure everything arrived.

### How many users can Google's data import move from Exchange Online at once?

Up to 1,000 Exchange Online users per import, according to Google's help page at the time of writing (October 2026). With 20 or fewer users the tool suggests mappings automatically. Above that, you upload a CSV with the headers Source Exchange Email and Target GUser, and larger organizations run separate imports.

### Do Outlook rules become Gmail filters?

Only with Google's advanced import method and its Import message rules as filters setting turned on. Google skips disabled rules and rules flagged with errors. With the default method, plan to recreate important rules as Gmail filters by hand, and check any forwarding rules before you rebuild them.

### Can I keep using Teams after moving email to Google Workspace?

Yes, but plan the Exchange side carefully. Exchange Online treats an authoritative accepted domain as local, so mail sent from inside your Microsoft 365 tenant to an address that still exists there is delivered internally, not by MX. Remove or convert old mailboxes, or route the domain onward, before you rely on Google.

### How long does Google take to start receiving mail after the MX change?

Google's MX help page says it can take up to 72 hours for new MX records to be recognized. In practice most senders follow the change once the old record's TTL expires, so lower the TTL a day ahead and keep the Microsoft 365 mailboxes accepting mail until traffic stops.

## Sources

- [Google Workspace Admin Help: Use the default data import method for Exchange Online](https://knowledge.workspace.google.com/admin/migrate/migrate-data-from-an-exchange-online-account)
- [Google Workspace Admin Help: What's imported in an Exchange Online import?](https://knowledge.workspace.google.com/admin/migrate/whats-migrated-in-an-exchange-online-migration)
- [Google Workspace Admin Help: Set up MX records for Google Workspace](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace)
- [Google Workspace Admin Help: Set up SPF](https://knowledge.workspace.google.com/admin/security/set-up-spf)
- [Google Workspace Admin Help: Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim)
- [Microsoft Learn: Manage accepted domains in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)
- [Microsoft Learn: Configure email forwarding for a mailbox in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/configure-email-forwarding)
- [Microsoft Learn: Control automatic external email forwarding](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/migrate-microsoft-365-to-google-workspace-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt