How to Migrate from IMAP to Office 365

Moving a domain off a generic IMAP host onto Office 365 sounds simple until you hit the source server's connection cap, a folder name with a slash in it, or a CSV that the Exchange Admin Center silently refuses. This guide walks you through Microsoft's built-in IMAP migration path step by step, with the gotchas that actually slow down real migrations: throttling, partial coverage (no calendar, no rules), and the cutover window where mail is in motion. It applies whether your source is cPanel, IONOS, Bluehost, Rackspace cloud-hosted IMAP, or any other host that speaks standard IMAP over port 993.

Before you start#

You need a few things in place before any migration batch will start cleanly. None of them are exotic, but missing any one of them is a guaranteed restart.

• A Microsoft 365 tenant with the domain you're migrating already added and verified as an accepted domain.
• Exchange Online (Plan 1 or higher) licenses assigned to each destination user, with each mailbox provisioned and reachable from Outlook on the web.
• The source IMAP server host name, the IMAP port (almost always 993 for TLS), and a working credential for at least one test mailbox.
• A list of every mailbox in scope with its source address, target address, and a known-working password. If the source supports admin impersonation, prefer that over per-user passwords; if not, you'll be collecting passwords.
• A Global Administrator or Exchange Administrator account in the target tenant.
• Time on the calendar. For mailboxes over 10 GB, plan an initial sync window of one to three hours per mailbox, then 24–72 hours of incremental sync before cutover.

The big constraint: source throttling#

Office 365 will happily pull as fast as the source lets it, which in practice means the source decides how long this takes. Most shared IMAP hosts impose a soft limit of roughly 10 simultaneous connections per source server, and many will throttle or temporarily ban an IP that exceeds it. If you have 200 mailboxes on one cPanel box and you tell the migration endpoint it can run 50 concurrent moves, you'll see waves of authentication failures and stalled batches within an hour.

The safer default is to start the migration endpoint at five concurrent migrations and five concurrent incremental syncs, then raise it only after the first batch completes without errors. Microsoft surfaces these as MaxConcurrentMigrations and MaxConcurrentIncrementalSyncs on the endpoint object.

The CSV file Microsoft expects#

The IMAP migration batch in Exchange Admin Center reads a CSV mapping file with one row per mailbox. The exact column headers are documented in the Microsoft docs and EAC will reject a file that's missing required headers, but at the level you need to know now: each row maps a source IMAP email address to a destination Office 365 user, with the source password for IMAP authentication. Save the file as UTF-8, keep it under 10 MB, and avoid quoted commas inside any field.

Two practical tips that save hours:

• Build the CSV from your source server's user list, not from memory or a spreadsheet that's been edited by three people. A typo in the source address makes the row fail in a way that's hard to spot in the EAC error report.
• For shared mailboxes or aliases, only include the underlying primary mailbox. EAC will refuse to migrate an alias as if it were a distinct mailbox, and you don't want it to anyway.

Migration steps#

1. Prepare licenses and accepted domain

   In the Microsoft 365 admin center, confirm your domain is added and the TXT verification has completed. Assign an Exchange Online license to every user in scope and confirm each destination mailbox is live by signing in to Outlook on the web at least once or by checking Get-Mailbox in Exchange Online PowerShell.

   If the destination mailboxes don't exist yet, create them now with placeholder passwords. The migration batch writes mail into them but does not provision the mailbox itself.

2. Test IMAP connectivity from Office 365

   From Exchange Online PowerShell, run Test-MigrationServerAvailability -IMAP -RemoteServer imap.yourhost.com -Port 993 -Security Tls. You're looking for a Success result. A failure here is almost always a firewall on the source side, a wrong port, or a TLS version mismatch. Fix it before you create the batch — every other problem in this guide is easier than debugging connectivity through EAC's UI.

   If your source host blocks Microsoft's outbound IP ranges, you'll need to allowlist them on the source firewall first. Microsoft publishes the ranges as part of the Office 365 IP and URL service.

3. Build the CSV mapping file

   Open a spreadsheet and create the mapping with one row per mailbox: source email address, destination user, source password. Save as UTF-8 CSV. Open it in a plain text editor and verify the file is comma-separated and that no row has stray quotes or line breaks inside a field.

   For environments with more than 100 mailboxes, split the CSV into batches of 50–100. Smaller batches are easier to retry when one mailbox stalls.

4. Create a migration endpoint in EAC

   In the Exchange Admin Center, go to Migration, then Endpoints, and add a new IMAP endpoint. Enter the source IMAP host name, port 993, and TLS as the security setting. Set MaxConcurrentMigrations to 5 and MaxConcurrentIncrementalSyncs to 5 to start. EAC will run a connection test against the endpoint before saving — if it fails here, you have the same root cause as step 2.

5. Create and start the migration batch

   Still in EAC under Migration, create a new batch. Pick IMAP as the migration type, attach the CSV, select the endpoint you just created, and choose the target domain. EAC asks whether to start the batch automatically — for the first batch, start it manually so you can inspect the configuration before it begins pulling.

   Once started, the batch enters Syncing state. Initial sync runs to completion, then the batch sits in Synced state and runs incremental sync once every 24 hours until you complete or delete it.

6. Monitor and resolve sync errors

   EAC shows per-batch and per-mailbox status. Watch for mailboxes stuck in Failed or Synced With Errors. The most common error categories are bad credentials (most often a password reset on the source that nobody told you about), folder name conflicts where the source has a folder name Office 365 can't accept, and message-too-large rejections for items over 150 MB.

   Re-run failed mailboxes individually rather than restarting the whole batch. EAC exposes a per-user retry that skips successful mailboxes.

7. Cut over DNS and complete the batch

   Two days before cutover, lower the MX TTL at your DNS provider to 300 seconds. On cutover day, change the MX record to point at your tenant's Office 365 endpoint (the *.mail.protection.outlook.com value listed in the admin center). Wait for propagation — usually 15 minutes to an hour with a low TTL — then complete the batch in EAC. Completing the batch stops further incremental syncs and finalizes the move.

   Leave the source mailboxes intact for at least 30 days. You will hear from at least one user who needs a folder you missed.

Gotchas that slow real migrations#

A few patterns show up over and over on IMAP to Office 365 jobs.

Folder name encoding. Older IMAP servers store folder names in modified UTF-7. If a user has a folder with non-ASCII characters — common with German, French or Japanese mailboxes — the migration may surface a Folder UTF-7 conversion error and skip that folder. Renaming the folder on the source to ASCII before the run is the simplest fix.

Mailbox size and item size limits. Office 365 mailboxes cap at 50 GB or 100 GB depending on the plan. If a source mailbox is larger, archive or split it before migrating. Individual messages over 150 MB will be rejected with Message too large for destination; these need to be exported manually.

Sent items duplication. Some IMAP clients copy outbound mail into a Sent folder on the server, others rely on the SMTP server to do it. After cutover, users on Outlook see Sent folders that look right, but the count may differ from what they saw on the source by a few percent. This is normal and not worth chasing.

Authentication failures mid-sync. If a source mailbox shows AUTHENTICATIONFAILED after initially succeeding, the source server is almost certainly rate-limiting or temp-banning the connection. Lower concurrency on the endpoint and let it recover.

If you want to compare the same workflow on a specific shared-hosting source, the cPanel to Office 365 guide and the Bluehost to Office 365 walkthrough drill into host-specific quirks that this generic IMAP guide skips over.

Errors you'll actually see#

A handful of error strings make up most of what EAC will throw at you during an IMAP to Office 365 migration.

• AUTHENTICATIONFAILED — wrong password, expired password, or rate-limited source. Check the source mailbox first, then lower concurrency.
• Too many simultaneous connections — your endpoint is exceeding the source's per-IP cap. Drop MaxConcurrentMigrations and retry.
• STARTTLS handshake failed — TLS version mismatch or the source IMAP server is listening on port 143 only. Confirm port 993 + TLS on the endpoint.
• Folder UTF-7 conversion error — non-ASCII folder name on source. Rename the folder on the source mailbox.
• Message too large for destination — single item over 150 MB. Export manually and re-import on the destination.
• OAuth2 token expired — only seen if the source has been wrapped in an OAuth gateway. Rare on IMAP migrations.

For deeper coverage of the connection-cap problem specifically, see the too-many-IMAP-connections fix. For protocol-level background, the IMAP protocol glossary entry covers ports, security modes, and folder semantics in one page.

Communicating with users#

Migration is a technical project until 8am on cutover day, then it becomes a communications project. A short, specific message to users a week before cutover prevents most of the tickets you'd otherwise field.

Tell users three things: the cutover date, what they need to do (usually: nothing the day before, then sign in to Outlook with their normal email and password on cutover day), and what's not coming across (calendar items more than 12 months old, server-side rules, signatures). Send a second reminder the day before and a third on the morning of cutover with a link to the sign-in instructions.

Avoid the temptation to bury this in a long FAQ. The skim-readable version is what people will act on. If your environment has shared mailboxes, call out the named owner of each one separately — shared mailboxes are where you'll discover the rule somebody set up in 2017 that nobody documented.

FAQ#

If you want a deeper background on how IMAP migration fits into the broader migration toolset, the complete email migration guide covers source/destination matrices, cutover strategy, and rollback. For the Microsoft side specifically, the Office 365 migration guide goes into tenant prep, hybrid options, and licensing.