Complete cloud onboarding checklist for SMBs (Microsoft 365 / Google Workspace)

The audit phase is often overlooked — and it is the number-one source of post-migration surprises. Before subscribing to a Microsoft 365 or Google Workspace plan, answer these questions:

Mailbox inventory:

• How many active email addresses? (include shared mailboxes: contact@, info@, billing@)
• What is each mailbox size? (in GB) — verify the target plan offers sufficient storage
• Are there mailboxes unused for over 6 months? Good time to clean up.

Existing collaboration tools inventory:

• Calendars: shared or individual? Recurring meetings to recreate?
• Contacts: shared or individual address book? Export format available?
• Shared files: Google Drive, Dropbox, SharePoint, local file server? Total volume in GB?
• Business apps connected to current email (CRM, helpdesk, ERP) — they will need reconfiguration after migration.

Plan selection:

• Microsoft 365 Business Basic (€6/user/mo): email + Teams + OneDrive. Office online only (no desktop install).
• Microsoft 365 Business Standard (€13.90/user/mo): same + Office desktop installable on 5 devices. Recommended for teams who use Word/Excel daily.
• Google Workspace Business Starter (€7.20/user/mo): Gmail + Meet + Drive 30 GB. Ideal if your team is already Google-native.

Internal communication: announce the migration to the team at least 2 weeks in advance. Specify the cutover week, the expected impact (a few hours of transition), and the support channel in case of issues. A surprise migration generates resistance and unnecessary support tickets.

Here is the recommended operational timeline to minimise disruption. Adapt based on your team size.

Day	Action	Owner
D-7	Add and verify the domain in the M365 / Google Workspace tenant. Create test user accounts (2–3 volunteers).	IT Admin
D-5	Start IMAP email sync (background copy of last 30 days). Verify test accounts receive test emails correctly.	IT Admin
D-3	Prepare DNS records (MX, SPF, DKIM, DMARC) as a draft — do not publish yet. Alert the team: "Cutover in 3 days".	IT Admin + Management
D-1	Create all final user accounts. Send invitations / temporary passwords. Train IT team on rollback procedure.	IT Admin
Day D (morning)	Lower MX record TTL to 300 seconds (5 min) at source registrar. Final backup of source mailboxes.	IT Admin
Day D (midday)	Publish new MX records. Activate SPF, DKIM, DMARC. Verify DNS propagation (dnschecker.org).	IT Admin
Day D (evening)	Deliverability test from each mailbox to Gmail/Outlook/Yahoo. Verify inbound anti-spam.	IT Admin + 2–3 users
D+2	Collect user feedback. Fix configuration issues (Outlook rules, signatures, delegations).	IT Admin
D+7	Deactivate source mailboxes (or keep read-only for 30 days). Close migration project.	IT Admin + Management

Rollback: if the MX cutover fails (lost emails, delivery issues), restore the old MX records. The TTL reduced to 300 seconds allows fast restoration. Emails received during the failed attempt are generally queued by sending servers for 24–48h.

Your account structure and naming convention are foundational choices that are hard to change later. Define them before creating the first account.

Email address naming convention:

• firstname.lastname@domain.com (e.g. marie.dupont@acme.com) — readable, professional, recommended for SMBs under 100 people.
• flastname@domain.com (e.g. mdupont@acme.com) — shorter, useful if you have many first-name duplicates in the team.
• Avoid first names alone (marie@): hard to manage when employees join or leave.

Distribution groups: create group addresses for your functional teams. In M365, these groups are "Microsoft 365 Groups" or "distribution lists" depending on the use case:

• sales-team@ → all sales staff receive the email
• support-team@ → shared queue for customer support
• management@ → CEO + CFO + COO

Shared mailboxes: for generic addresses (info@, contact@, billing@), use Microsoft 365 "Shared Mailboxes" (free, no dedicated licence). Multiple people can read and reply from the same address, with a shared history visible to the entire assigned team.

Aliases: a user can have multiple email addresses arriving in the same mailbox. Example: marie.dupont@ (primary address) + m.dupont@ (old format, to avoid losing incoming emails during transition). Aliases are free and unlimited.

Best practices: document in a shared file (OneDrive or Google Sheet) the complete list of accounts, groups, shared mailboxes and aliases. This document becomes the reference for future onboarding and offboarding.

Security setup cannot wait until "later". Cloud accounts without MFA are the primary target of credential stuffing attacks. Here are the actions to take before users start working on their new accounts:

1. Mandatory MFA for all accounts:

• On Microsoft 365: Entra ID (Azure AD) → Security → Authentication methods → Enable "Microsoft Authenticator" for all users. Or more simply: enable Security Defaults (free, enabled by default on new tenants since 2022).
• On Google Workspace: Admin Console → Security → 2-Step Verification → Turn on enforcement for all users.

2. Complex passwords: configure a minimum 12-character password policy with complexity requirements. On M365, this policy is managed in Entra ID. Communicate clearly to users that they must change their provisional password on first login.

3. Conditional Access (M365 Business Premium): if you have a Premium plan, configure conditional access rules: block login from countries where the company does not operate, require a compliant device (Intune) for mobile email access, block legacy protocols (IMAP/POP/SMTP basic auth) that bypass MFA.

4. Administrator alerts: configure email alerts for critical security events: login from a new country, repeated login failures, global admin addition, suspicious email forwarding rules (a classic sign of account compromise). On M365: Microsoft Defender portal → Policies → Alert policies.

5. Legacy protocol disabling: IMAP/POP/SMTP with Basic Auth (login/password without MFA) are major attack vectors. Disable them explicitly if your organisation does not need them. Most modern email clients (Outlook 2016+, Apple Mail, recent Thunderbird) support OAuth2 and do not require these protocols.

A successful cloud migration also requires correct deployment of client applications. Here is the standard list for a Microsoft 365 SMB:

On Windows workstations (Business Standard or above):

• Microsoft 365 Apps (Office): deploy via M365 Admin portal → Apps → Microsoft 365 Apps for business. Users download and install from office.com. On 5 devices per user (PC, Mac, tablet).
• Outlook desktop: configure with the professional email address (autodiscover works on M365 — configuration is done by entering the email, that is all). Optionally import the PST from the old mailbox.
• Teams: desktop app to install separately from teams.microsoft.com or via the admin portal. Create a desktop shortcut on all workstations. Add Teams to Windows startup.
• OneDrive: installs automatically with Office. Configure synchronisation of the OneDrive Pro folder (company Documents). Watch bandwidth during initial sync if volume is significant.

On Mac: M365 apps are available via the Mac App Store or directly from the office.com portal. Configuration is identical to Windows.

On mobiles (iOS and Android):

• Outlook mobile: best M365 integration, calendar and contact management, shared mailbox support. Recommended over the native email client.
• Teams mobile: push notifications, Teams calls, file sharing on the go.
• OneDrive mobile: access to OneDrive files, document scanning.
• Microsoft Authenticator: MFA app — install before enabling MFA to avoid being locked out.

For teams on Google Workspace, the equivalent list is: Gmail (web or app), Google Drive (app + sync), Google Meet, Google Chat, and the Google Authenticator app for MFA.

Resistance to change is the primary cause of cloud migration failure in SMBs — not technical issues. A short but well-structured training programme significantly reduces the post-migration support load.

Day 1 — Plenary kickoff (1h, whole team):

• Presentation of migration reasons (5 min): be concrete — "you will have Office on your PC, no more manual backups to USB drives".
• Live Teams demonstration (15 min): create a channel, send a message, start a video meeting, share a file. Users see the value immediately.
• OneDrive presentation (10 min): show automatic sync, sharing a file with a colleague, and recovering a previous version.
• Q&A (30 min): questions come in volume, plan time for this. Note recurring concerns to address in Day 2 workshops.

Day 2 — Hands-on workshops in groups of 5–8 (1h each):

• Calendars workshop: create a recurring event, share your calendar with a colleague, delegate calendar management, accept/decline a Teams invitation.
• OneDrive workshop: move files from Desktop to OneDrive, create a shared folder with a team, co-edit a Word document in real time.
• Outlook workshop: create filter rules, configure your professional signature, use colour categories, enable reply notifications.

Internal PDF guide: prepare a one-page guide per tool (Outlook, Teams, OneDrive) with the 5 most common actions illustrated with screenshots. Publish it on SharePoint or Google Sites. This guide reduces "how do I do X?" support tickets by 60%.

For individual security management, direct your users to our detailed guide: Enable 2FA for all Microsoft 365 users — step-by-step procedure with screenshots.