We have migrated over 30 TB from file servers to SharePoint Online in the last 4 years. The pattern repeats, and so do the mistakes. This playbook condenses what we learned.
Phase 0: Discovery (2-3 weeks)
Before moving a single file you need to know what is there. Use ShareGate Scanner or PnP PowerShell to inventory: size per folder, age, owners, ACLs, duplicate content, orphan files. This phase takes time but saves months.
Phase 1: Cleanup (1-2 weeks)
Hard fact: 35% of files in typical file servers are duplicated or obsolete. Do not migrate garbage. Take the chance to archive inactive data and remove duplicates. Users do not protest as much as you think if the process is transparent.
Phase 2: Architecture (3-4 weeks)
- Hub-and-spoke site architecture, with 3-7 hubs per department or geography.
- Managed term store taxonomy with at least 2 levels per hub.
- Default sensitivity labels, applied automatically with Purview.
- Permissions: break NTFS ACLs and map to Azure AD groups. Period.
Phase 3: Wave-based migration (8-12 weeks)
Waves of 500 GB to 2 TB. SharePoint Migration Tool for the bulk (free up to 100 GB per job, enough), ShareGate for critical ones with preserved version history and metadata. Validate after each wave with PnP scripts that report missing files, permission errors, locked files.
Recurring mistakes
- Migrating permissions as-is without simplifying. You end up with 15 levels of nested groups that nobody understands.
- Forgetting legal retention. Post-migration audit finds 100% of the non-conformities.
- Training at the end. Users who discover SharePoint in production generate tickets. Pre-training reduces support 60%.
14+ years leading enterprise digital transformation projects in LATAM and Europe. Founder of TIKAL SOLUTIONS.
Ready for your next project?
Let's talk 20 minutes about your challenge. No commitment.
Keep reading
Copilot and data security in M365: Purview, sensitivity labels and governance
What 80% of companies forget before activating Copilot. The Purview, retention and oversharing configuration that prevents security incidents.
Microsoft 365 Copilot: what it can (and cannot) do by role
Practical guide by role — Sales, HR, Marketing, IT, Finance — to understand where Copilot adds real value from day one and where it still fails.
GitHub Copilot in enterprise teams: adoption, DORA metrics and governance
What we learned deploying GitHub Copilot Business in teams of 50-300 developers. Real metrics, usage policy, AI code review.