Migrating from Microsoft 365 to Mailcow

Moving from Microsoft 365 to Mailcow is a standard migration for us. From our experience it goes smoothly in 99% of cases. Two paths: you use the free IMAP migration tool in the mailbox backend yourself, or we handle the complete migration — that’s a flat fee, the current conditions are on the Mailhosting product page.

This article describes the assisted variant: what you do as domain admin and what we do.

Preparation

Before we start, we need from you:

1. List of mail addresses to migrate — e.g. info@deinverein.de, vorname@deinverein.de.
2. Microsoft 365 admin access or, per address, an app password that gives us IMAP access.
3. Mailboxes already created in Mailcow — see Creating mailboxes. We migrate into these mailboxes.

You create app passwords in Microsoft 365 under:

• account.microsoft.com → Security → Advanced security options → App passwords
• Or in the admin center for the domain — depending on your configuration

Careful: in some Microsoft 365 setups, “Basic Authentication” is disabled. Then you have to enable it temporarily for the migration phase or use OAuth — more on that below.

We migrate — you get regular updates

You open a ticket: “Migration MS365 to Mailcow for domain X, here are the mailboxes and credentials”.

We use imapsync with the right options for Microsoft 365 (Office 365-specific auth quirks). The migration runs in the background per mailbox — you see no interruption in MS365.

What gets copied:

• All mails with their original date
• All folder structures (nested ones too)
• Read/unread status and mail flags
• Mail labels and tags (as far as IMAP-compatible)

What is not migrated automatically:

• Calendars and contacts — we export those separately, see below
• Sieve filters and Outlook rules — you have to recreate those in Mailcow
• Out-of-office notices — set up again in SOGo

Duration and billing

The assisted migration is billed as a flat fee — regardless of how long the sync runs. The conditions are on the Mailhosting product page.

Per mailbox, the duration depends on the data volume:

• 5 GB → 30–60 minutes
• 20 GB → 2–4 hours
• 50 GB → 6–10 hours

For large mailboxes we start at night, so MS365 stays undisturbed during the day. We do one initial sync, then incremental follow-up syncs until you say “switch now”.

The cutover day — DNS switch

Once the initial migration is done, you plan a cutover day. Typical flow:

Day X-1, evening (e.g. Friday 10 pm):

1. We start the final incremental sync — fetching the current delta from MS365 to Mailcow.
2. You change the DNS MX records: previously Microsoft, now our mail servers. We give you the exact DNS values.
3. DNS propagation takes 1–4 hours (or longer, depending on TTL).

Day X (e.g. Saturday morning): 4. Mails now arrive at Mailcow, no longer at MS365. 5. We run one last delta sync in case anything else arrived at MS365. 6. Users switch their mail clients to Mailcow (change the server details).

Day X+1 to +14: 7. We keep the sync to MS365 active for another week (as a safety net, in case mails still trickle in there). 8. The MS365 mailboxes are no longer actively used during that period.

Day X+14: 9. You can cancel the MS365 subscription.

Migrating calendars

Export Microsoft 365 calendars:

1. Open Outlook on Windows or Mac.
2. Per calendar: File → Save as → iCalendar (.ics).
3. Store the file temporarily.

Import into SOGo:

1. Open SOGo webmail → Calendar tab.
2. Select the calendar to import into.
3. Import → choose the ICS file → OK.

That transfers all events including recurrences. Event invitations are not sent out again.

With very many events: better to use a script. Open a ticket, we’ll do it.

Migrating contacts

From Microsoft 365 / Outlook:

1. Outlook → File → Import/Export → Export to a file.
2. Choose Comma Separated Values (CSV).
3. Contacts as the source.
4. Save the file.

Convert CSV to vCard (if necessary): online with csv2vcf.com or via script.

Import into SOGo:

1. SOGo webmail → Address books tab.
2. Import → choose the file.

SOGo accepts vCard and simple CSV formats. For complex CSV structures with special Outlook fields: convert to vCard first.

OAuth instead of Basic Auth

If Microsoft 365 has Basic Auth disabled in your tenant, we use OAuth:

1. You register an Azure AD app with mail-read permissions and give us the client ID and the secret.
2. We use OAuth-based IMAP authentication.

That’s a bit more setup effort, but for many Microsoft 365 tenants without a Basic Auth exception it’s the only way.

Open a ticket, we walk you through the Azure AD app registration — takes about 15 minutes.

What to check after the migration

Check the MX record: enter your domain at mxtoolbox.com — the MX record should now point to our mail servers, no longer to Microsoft.

Send test mails: once from an external address (Gmail) to the migrated mail address. It should arrive — with us, no longer at MS365.

Set up out-of-office: was “Automatic Replies” in MS365. In SOGo: Settings → Vacation.

Recreate Sieve filters: the Outlook rules from MS365 can’t be migrated because they were client-side. Create new rules in SOGo — see Personal Sieve filters in webmail.

Reconfigure mail clients: point Outlook and the end users’ other clients at the Mailcow servers. Server details in the server details reference.

What can go wrong

Modern Authentication blocks IMAP: many MS365 tenants have Basic Auth disabled. Solution: OAuth (see above) or temporarily enable Basic Auth (Microsoft still allows this on request for existing tenants, for a while).

Throttling on the MS365 side: Microsoft throttles IMAP after high volume. We notice it on large migrations — we adjust the sync speed, it takes longer then, but it works.

Time zone shifts: with calendar migration, events can end up shifted by an hour. Check manually, readjust in SOGo.

Very old mails are missing: if the MS365 license has mailbox size limits, older mails may already be archived or deleted. Check in MS365 whether “auto-archiving” was active.

Frequently asked questions

Is the migration free? The self-service IMAP tool in the mailbox backend: yes. If we handle the complete migration: flat fee, no hourly-rate poker — the current price is on the Mailhosting product page. We assist with the DNS switch in both cases if you want.

How long does the whole migration take end-to-end? Small setups (5 mailboxes, 5 GB each): 1 day. Medium (25 mailboxes, 20 GB each): 2–4 days. Large (100+ mailboxes): several weeks, in waves.

Can we work normally during the migration? Yes. Mails keep arriving at MS365, you work there as usual. Only at the DNS switch do mails land at Mailcow — until then, every mail still has a home.

What if a mail client refuses to come along? Sometimes caching problems. Solution: delete the account from the mail client, recreate it with the Mailcow details. Mails are pulled fresh from the server.

What happens to shared mailboxes? MS365 shared mailboxes have no password of their own. We set them up in Mailcow as a regular mailbox with its own password, or as a catchall with forwarding to internal recipients.

Are spam filter rules migrated? No. The SpamAssassin/Rspamd configuration on Mailcow is server-side, we handle that. Domain-wide whitelist and blacklist you set up fresh in the Mailcow GUI.

What happens to smartphones connected via Exchange/ActiveSync? The old Exchange account on the device won’t keep working after the move — we don’t offer ActiveSync. End users set up their mailbox fresh: IMAP/SMTP for mail, CalDAV/CardDAV for calendar and contacts (easiest on the iPhone via configuration profile, see Apple Mail on iPhone and iPad). Straight talk on delivery: clients with IMAP IDLE show new mails practically instantly, iOS Mail only polls IMAP accounts at intervals (Settings → Mail → Accounts → Fetch New Data). We recommend sending a short guide to all end users on cutover day.

Can we run in parallel? Yes, for a while. As long as the DNS MX records point to MS365, mails arrive there. But you can already send mails from Mailcow — the recipient won’t notice anything odd.

What’s next

• Migrating from Google Workspace to Mailcow
• Migrating from a classic IMAP provider
• Building mail reputation