Microsoft 365 migration checklist for UK SMEs: the 14 things people forget

1. Inventory every account that uses your domain for email. Not just staff. Shared mailboxes, distribution lists, the alias the accounts software sends from, the address the website contact form replies to, the booking system, the printer that emails scanned PDFs. Every one of these needs a decision before cutover, and the list is always longer than people expect.

2. Find every line-of-business app that sends mail through your current server. Sage, Xero, your CRM, the booking system, the alarm panel, the colour photocopier. Each one needs reconfiguring to send through Microsoft 365 or through a dedicated SMTP relay. Missing one is a near-guaranteed Monday-morning surprise.

3. Audit your DNS. Most SMEs don't know who owns their DNS or whether they can edit it. If it's at GoDaddy under the founder's personal account, sort that out now, not the night of the cutover.

4. Pick the right licence plan, honestly. Business Premium (around £18.10 per user per month) is the right floor for most UK SMEs because it includes the security tooling. Business Standard is cheaper but skips Defender, Intune and Conditional Access. If you're regulated or growing, Premium is rarely the wrong answer.

5. Configure SPF, DKIM and DMARC for the new tenant before cutover. Skipping DMARC is how perfectly legitimate post-migration mail starts landing in clients' spam folders, and how spoofers keep spoofing your domain unnoticed.

6. Enable MFA for every user before cutover, not as a follow-up. Conditional Access can ease the friction by trusting known devices, but the principle is non-negotiable. Cyber insurers, clients and the ICO all assume it's already on.

7. Design SharePoint and Teams with each function, not as one big site for everyone. The hour spent agreeing structure with the team that'll actually use it saves a year of confusion afterwards.

8. Decide your retention policy before go-live. How long are emails kept. How long are deleted files recoverable. What happens to a leaver's mailbox after 30 days. Purview makes this configurable, but you have to make the decisions.

9. Do a pilot group first. Two or three users (ideally including one director and one help-desk-heavy user) moved a week before everyone else surfaces 80 percent of the issues you'd otherwise hit at full scale.

10. Cut over outside working hours, but not in the small hours. Friday evening into Saturday morning is the standard pattern. Sunday night gives you Monday to fix issues; Friday gives you the weekend.

11. Lower DNS TTLs (the time-to-live on your DNS records) at least 48 hours before cutover, so the MX flip actually propagates fast. This single step prevents the most common cutover complaint, that some senders are still mailing the old server hours after the move.

12. Have someone watching the mail queue and the help desk for the first four working hours on Monday. A real person, not a ticketing system. The issues are usually small and quick if caught early, and expensive if left to fester.

13. Enrol devices into Intune within 30 days of cutover, while attention is still on the migration. Compliance policies tied to Conditional Access mean only managed devices can reach company data, which closes most of the gaps cyber insurers ask about. Leaving this for a later phase usually means it never happens.

14. Run a short post-mortem at the four-week mark. What still isn't right. Which app is still pointing at the old server. Which team is still using Dropbox out of habit. This is the meeting that turns a migration from a project into a working platform.

A few honourable mentions that aren't strictly checklist items but reliably catch UK SMEs out. Email signatures: someone needs to own the new signature template and roll it out, or every staff member will hand-craft a different one. Shared calendars: the room and equipment mailboxes need creating and permissions tested before the first booking lands. Mobile devices: personal phones need a clear policy and a clean way to access Outlook, ideally through MAM rather than full enrolment. Backup: Microsoft 365 retains data, it does not back it up the way most people assume, and a third-party backup tool is worth budgeting for separately.

None of this is new. All of it is what separates a migration people forget within a month from one they're still complaining about a year later. The partners worth working with already know this list and run it as standard. The ones who don't will tell you these are extras and quote them separately.

Tell us your team size, current setup, and what's triggering the move. We'll introduce you to a UK partner who treats every item on this list as table stakes, not optional polish.