Executive Summary

Migrating an enterprise organization from Google Workspace (Gmail, Google Drive, Google Calendar, Google Chat) to Microsoft 365 (Exchange Online, OneDrive for Business, SharePoint Online, Microsoft Teams) represents one of the most critical infrastructure transformations an IT team can undertake.

When executing migrations at enterprise scale (5,000 to 50,000+ seats), trivial manual approaches fail due to API rate limits, OAuth token expirations, permission translation nuances, and user productivity disruption.

This comprehensive guide details the Production-Grade Architecture Blueprint utilized by EpiFive architects across dozens of Fortune 500 cloud transformations.

---

Phase 1: Directory Synchronization & Identity Foundation

A successful migration begins with Identity Coexistence. All users in Google Workspace must have corresponding objects provisioned in Microsoft Entra ID (formerly Azure AD) prior to initiating mailbox sync.

1. Source & Target Identity Matching

Ensure every user account has a matching Primary SMTP address and UserPrincipalName (UPN) in Entra ID.

# Verify Entra ID User Identity Status

Connect-MgGraph -Scopes "User.Read.All", "Directory.Read.All"



Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, Mail, ProxyAddresses | 

    Export-Csv -Path "C:\Migration\EntraID_IdentityReport.csv" -NoTypeInformation

2. Domain Federation & Coexistence

During the migration phase, set up a secondary routing domain in both environments:

• Target Domain in M365: epifive.mail.onmicrosoft.com
• Source Routing Domain in Google: gsuite.epifive.com

---

Phase 2: Google Cloud Platform (GCP) Service Account & OAuth2 Configuration

To allow Exchange Online Migration Service or migration tools (e.g., BitTitan MigrationWiz, Quest On Demand) to pull data from Gmail, Calendar, and Drive, you must provision a Google Cloud Service Account with Domain-Wide Delegation.

Required OAuth2 Scopes

1. https://mail.google.com/ (Full Gmail Access)
2. https://www.googleapis.com/auth/calendar (Google Calendar)
3. https://www.googleapis.com/auth/contacts (Google Contacts)
4. https://www.googleapis.com/auth/drive (Google Drive & Shared Drives)

{

  "type": "service_account",

  "project_id": "epifive-m365-migration-prod",

  "private_key_id": "a9b8c7d6e5f41234567890abcdef",

  "client_email": "migration-sa@epifive-m365-migration-prod.iam.gserviceaccount.com",

  "client_id": "118239485760192837465",

  "auth_uri": "https://accounts.google.com/o/oauth2/auth",

  "token_uri": "https://oauth2.googleapis.com/token"

}

---

Phase 3: Exchange Online Migration Endpoint Creation

In the Exchange Admin Center (EAC), establish the Google Workspace migration endpoint pointing to the GCP Service Account client ID and private key.

# Connect to Exchange Online PowerShell V3

Connect-ExchangeOnline -UserPrincipalName admin@epifive.com



# Create Native Exchange Online Google Workspace Migration Endpoint

New-MigrationEndpoint -GSuite -Name "GoogleWorkspace_EAC_Endpoint" `

    -ServiceAccountEmailAddress "migration-sa@epifive-m365-migration-prod.iam.gserviceaccount.com" `

    -PFXData ([System.IO.File]::ReadAllBytes("C:\Migration\GCP_ServiceAccount_Key.p12")) `

    -EmailAddress "admin@epifive.com"

---

Phase 4: Batch Mailbox Migration Execution

Automate batch creation using CSV mapping files containing source Gmail addresses and destination M365 UPNs.

| EmailAddress | TargetDeliveryDomain |

| :--- | :--- |

| user1@epifive.com | epifive.mail.onmicrosoft.com |

| user2@epifive.com | epifive.mail.onmicrosoft.com |

# Create and Start Batch 1 (1,000 Users)

New-MigrationBatch -Name "Batch_Finance_01" `

    -SourceEndpoint "GoogleWorkspace_EAC_Endpoint" `

    -CSVData ([System.IO.File]::ReadAllBytes("C:\Migration\Batch_Finance_01.csv")) `

    -TargetDeliveryDomain "epifive.mail.onmicrosoft.com" `

    -AutoStart -AutoComplete

---

Phase 5: Google Drive to OneDrive & SharePoint Migration

Google Drive items and Shared Drives are migrated into OneDrive for Business and SharePoint Online Document Libraries using Microsoft Migration Manager.

Permission Mapping Table

• Google Owner $\rightarrow$ OneDrive / SharePoint Site Collection Admin
• Google Editor $\rightarrow$ SharePoint Edit / Contribute Member
• Google Viewer $\rightarrow$ SharePoint Visitor (Read Only)

---

Phase 6: MX Cutover & Post-Migration Validation

1. Perform Final Delta Sync: Sync incremental changes from Gmail/Drive over the final 24 hours.
2. Update DNS MX Record: Change domain MX record to point to EOP (epifive-com.mail.protection.outlook.com).
3. Update Autodiscover CNAME: Point autodiscover.epifive.com to autodiscover.outlook.com.
4. Decommission Source Forwarding: Remove secondary mail routing connectors in Google Admin console after 72 hours propagation buffer.

> Architecture Result: Zero email loss, complete preserve of calendar appointments and shared file ACLs, with 100% compliance under SOC 2 and ISO 27001 auditing standards.