# Exchange Online

This Book Section holds Exchange Online related documentations

# Outlook Desktop - Repeated Sign-In Prompt (WAM BrokerPlugin Reset)

<table class="MsoNormalTable" id="bkmrk-field-details-docume" style="width:69.2857%;height:178.781px;" title=""><tbody><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">**Field**

</td><td style="width:80.1653%;height:29.7969px;">**Details**

</td></tr><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">Document Type

</td><td style="width:80.1653%;height:29.7969px;">Known Issue - Workaround

</td></tr><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">Applies To

</td><td style="width:80.1653%;height:29.7969px;">Microsoft Outlook Desktop (Classic), Windows 10/11, Microsoft 365 / Exchange Online

</td></tr><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">Audience

</td><td style="width:80.1653%;height:29.7969px;">2nd Line Support / Exchange Online Admins

</td></tr><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">Author

</td><td style="width:80.1653%;height:29.7969px;">AK. Udofeh

</td></tr><tr style="height:29.7969px;"><td style="width:19.6199%;height:29.7969px;">Last Updated

</td><td style="width:80.1653%;height:29.7969px;">February 2026

</td></tr></tbody></table>

<span style="font-family:pplxSerif, pplxSerif, 'ui-serif', Georgia, Cambria, serif;font-size:16px;font-style:normal;letter-spacing:normal;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none;">**Overview**  
This article documents a workaround for a recurring issue where Outlook Desktop prompts users to sign in repeatedly — as frequently as every 15 minutes to every hour - without retaining the session after completing authentication. This issue can affect individual users or a large number of users simultaneously across an organisation.</span>

## **The Issue**

Users open Outlook and are presented with a **"Sign In"** prompt unexpectedly. After signing in successfully, the prompt reappears again after a short period. The following self-service steps do **not** resolve the issue:

- Restarting the laptop or PC
- Signing out of Outlook and signing back in
- Restarting Microsoft Teams or other Office apps

The issue may also surface across other Microsoft 365 services (Teams, OneDrive, SharePoint) simultaneously, as they share the same underlying authentication component.

## **Root Cause**

Modern Microsoft 365 applications do not handle authentication directly. Instead, they delegate all sign-in and token management to a Windows OS component called **Web Account Manager (WAM)** and its associated background plugin: **`Microsoft.AAD.BrokerPlugin`**.

## Normal Authentication Flow

<table id="bkmrk-user-opens-outlook%C2%A0--1" style="border-collapse:collapse;width:51.0714%;height:200px;"><colgroup><col style="width:100%;"></col></colgroup><tbody><tr><td>User opens Outlook  
 ↓  
Outlook requests a token from WAM  
 ↓  
WAM calls Microsoft.AAD.BrokerPlugin  
 ↓  
Plugin communicates with Microsoft Entra ID  
 ↓  
Entra ID returns an OAuth access token (valid ~1 hour)  
 and a refresh token (valid up to 90 days)  
 ↓  
WAM silently refreshes the token in the background  
when it expires - user is never prompted again  
</td></tr></tbody></table>

## **What Breaks the Flow**

When the **`Microsoft.AAD.BrokerPlugin`** folder becomes corrupted or enters a broken state, the silent background refresh fails. When the 1-hour access token expires, Outlook falls back to prompting the user because WAM cannot silently obtain a new one.

## **Known Triggers**

This corruption can occur due to, but is not limited to:

- **Windows OS cumulative/security updates** (confirmed trigger - February 2026 Patch Tuesday, build 10.0.29510.1001 and earlier - January 2026 KB5074109)
- Incomplete or interrupted Microsoft 365 app updates
- User profile corruption
- Mid-session password or MFA changes in Entra ID
- Entra ID token store inconsistencies after account modifications

<p class="callout info">This workaround applies to all of the above scenarios. If a user is experiencing the repeated Outlook sign-in prompt and no Conditional Access policy or service health incident is identified as the cause, resetting the BrokerPlugin is the recommended first-line fix.</p>

## **Before You Start**

Rule out the following before applying this fix at scale:

<table id="bkmrk-check-where-active-m" style="border-collapse:collapse;width:100%;font-family:Arial, sans-serif;"><thead><tr><th class="border-subtle p-sm break-normal border-b text-left align-bottom border-r last:border-r-0 font-bold bg-subtler last:border-radius-tr-lg first:border-radius-tl-lg" style="background-color:#f2f2f2;border:1px solid #ddd;padding:8px;text-align:left;">Check</th><th class="border-subtle p-sm break-normal border-b text-left align-bottom border-r last:border-r-0 font-bold bg-subtler last:border-radius-tr-lg first:border-radius-tl-lg" style="background-color:#f2f2f2;border:1px solid #ddd;padding:8px;text-align:left;">Where</th></tr></thead><tbody><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Active Microsoft service incident</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">M365 Admin Center &gt; Health &gt; Service Health</td></tr><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Recently modified Conditional Access policy</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Entra Admin Center &gt; Protection &gt; Conditional Access</td></tr><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">User password recently expired or changed</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Entra Admin Center &gt; Users</td></tr><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Entra sign-in logs showing policy interrupts</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid #ddd;padding:8px;text-align:left;">Entra Admin Center &gt; Monitoring &gt; Sign-in Logs</td></tr></tbody></table>

If none of the above are present, proceed with the fix below.

## **Fix: Manual Steps (Per Machine)**

<p class="callout info">Run on the affected user's machine, logged in as that user. You do not need to be a local admin for Steps 1–4.</p>

## **Step 1: Close All Microsoft Applications**

Fully close **Outlook, Teams, OneDrive** and any other Office applications. Check the system tray and ensure none are still running in the background.

## **Step 2: Navigate to the BrokerPlugin Folder**

<span style="font-family:pplxSerif, pplxSerif, 'ui-serif', Georgia, Cambria, serif;font-size:16px;font-style:normal;letter-spacing:normal;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none;">Press </span>`Win + R`<span style="font-family:pplxSerif, pplxSerif, 'ui-serif', Georgia, Cambria, serif;font-size:16px;font-style:normal;letter-spacing:normal;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none;"> and enter:</span>

`%localappdata%\Packages`

<span style="font-family:pplxSerif, pplxSerif, 'ui-serif', Georgia, Cambria, serif;font-size:16px;font-style:normal;letter-spacing:normal;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline;float:none;">Locate the following folder:</span>

`Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy`

## **Step 3: Rename the Folder**

Rename the folder by appending `.old` to the end:

`Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old`

<p class="callout warning">Do not delete the folder. Renaming it preserves a backup and instructs Windows to recreate it fresh on next boot. If you encounter the error "The action can't be completed because the folder or a file in it is open in another program", see the Troubleshooting section below before continuing.</p>

## **Step 4: Clear Cached Credentials**

1. Open **Control Panel → Credential Manager → Windows Credentials**
2. Remove all entries beginning with:

- `MicrosoftOffice16_*`
- `msteams_*`
- `Microsoft_OC_*`
- Any entry referencing `office.com` or `outlook.com`

## **Step 5: Reboot the Machine**

Perform a **full restart** (not sign out). Windows will automatically recreate the `Microsoft.AAD.BrokerPlugin` folder in a clean state on boot.

## Step 6: Sign Back Into Outlook

Open Outlook. When prompted, sign in once. The session should persist without re-prompting.

### **Fix: Automated Script (Bulk Deployment)**

Use this script for fleet-wide remediation via RMM tool, Intune Remediation Script, or GPO logon script.

<p class="callout warning">Important: This script must run in the affected user's context, not as SYSTEM or a local admin account. The BrokerPlugin folder is per-user profile.</p>

```powershell
# Step 1: Kill processes holding the BrokerPlugin before rename
Stop-Process -Name "Microsoft.AAD.BrokerPlugin" -Force -ErrorAction SilentlyContinue
Stop-Process -Name "backgroundTaskHost" -Force -ErrorAction SilentlyContinue
Stop-Process -Name "RuntimeBroker" -Force -ErrorAction SilentlyContinue

# Brief pause to allow process termination to complete
Start-Sleep -Seconds 2

# Step 2: Rename the BrokerPlugin folder
$brokerPath = "$env:LOCALAPPDATA\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy"

if (Test-Path $brokerPath) {
    try {
        Rename-Item -Path $brokerPath -NewName "$brokerPath.old" -Force -ErrorAction Stop
        Write-Output "SUCCESS: BrokerPlugin reset complete. Reboot required."
    }
    catch {
        Write-Output "ERROR: Failed to rename BrokerPlugin folder. $($_.Exception.Message)"
    }
} else {
    Write-Output "INFO: BrokerPlugin folder not found or already reset. No action taken."
}

```

**Post-deployment:** Push a reboot policy immediately after the script runs, or instruct users to restart when prompted.

## Troubleshooting — "The Action Can't Be Completed" Rename Error

If Windows displays:

> *The action can't be completed because the folder or a file in it is open in another program"*

This means a background Windows process is still holding a lock on the folder even though all visible apps are closed. The `Microsoft.AAD.BrokerPlugin` process runs silently in the background and can respawn quickly. Use the following method to identify and terminate it before retrying the rename:

## Using Windows Resource Monitor (No Additional Tools Required)

1. Press `Win + R` and run:

`perfmon.exe /res`

1. In Resource Monitor, select the **CPU** tab
2. Scroll down and expand the **Associated Handles** section
3. In the search box, type:

`AAD.BrokerPlugin`

1. Press **Enter** — Resource Monitor will display all processes currently holding a handle on the folder
2. Right-click each result → **End Process**
3. Immediately return to the folder and complete the rename (Step 3 above) before the process respawns

## **Expected Outcome**

<table id="bkmrk-%C2%A0-%C2%A0-resolution-time-" style="border-collapse:collapse;width:100%;font-family:Arial, sans-serif;"><thead><tr><th class="border-subtle p-sm break-normal border-b text-left align-bottom border-r last:border-r-0 font-bold bg-subtler last:border-radius-tr-lg first:border-radius-tl-lg" style="background-color:rgb(242,242,242);border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:23.3929%;"> </th><th class="border-subtle p-sm break-normal border-b text-left align-bottom border-r last:border-r-0 font-bold bg-subtler last:border-radius-tr-lg first:border-radius-tl-lg" style="background-color:rgb(242,242,242);border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:76.7263%;"> </th></tr></thead><tbody><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:23.3929%;">**Resolution time**</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:76.7263%;">Under 5 minutes + reboot</td></tr><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:23.3929%;">**User impact**</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:76.7263%;">One-time sign-in prompt after reboot, then session persists normally</td></tr><tr><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:23.3929%;">**Recurrence**</td><td class="px-sm border-subtle min-w-[48px] break-normal border-b border-r last:border-r-0" style="border:1px solid rgb(221,221,221);padding:8px;text-align:left;width:76.7263%;">Should not recur unless a subsequent update re-introduces the regression</td></tr></tbody></table>

# Google Workspace to Exchange Online Mail Migration

<table class="MsoNormalTable" id="bkmrk-field-details-docume" title=""><tbody><tr><td>**Field**</td><td>**Details**

</td></tr><tr><td>Document Type

</td><td>Google Workspace to Exchange Online Mail Migration

</td></tr><tr><td>Applies To

</td><td>Exchange Online, Google Workspace, Google API, Google Cloud

</td></tr><tr><td>Audience

</td><td>Systems Administrator / IT Engineer

</td></tr><tr><td>Author

</td><td>AK. Udofeh

</td></tr><tr><td>Last Updated

</td><td>May 2026

</td></tr></tbody></table>

## **<span style="font-family:SimSun;">[![google-exchange migration.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-05/scaled-1680-/google-exchange-migration.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-05/google-exchange-migration.png)</span><span style="font-family:SimSun;">Overview</span>**

This configuration enables mailbox migration from Google Workspace (Gmail) to Microsoft Exchange Online using the native migration functionality built into the Exchange Admin Center (EAC).

The migration process uses a Google Cloud service account with delegated access to securely read Gmail, Calendar, and Contacts data from Google Workspace and import it into Microsoft 365 mailboxes.

This approach is important because it:

- <span> </span>Enables centralized migration management from Microsoft 365
- <span> </span>Supports staged or pilot migrations
- <span> </span>Minimises manual mailbox export/import operations
- <span> </span>Preserves mail, calendars, and contacts during migration

The configuration mitigates risks associated with:

- <span> </span>Manual PST exports
- <span> </span>Incomplete mailbox migrations
- <span> </span>Credential sharing
- <span> </span>Unsecured mailbox access methods

##### **<span style="font-family:SimSun;">Prerequisites</span>**

##### **<span style="font-family:SimSun;">Required Licenses</span>**

##### **<span style="font-family:SimSun;">Microsoft 365</span>**

- <span> </span>Exchange Online Plan 1 or higher
- <span> </span>Microsoft 365 Business Premium / E3 / E5 recommended

##### **<span style="font-family:SimSun;">Google Workspace</span>**

- <span> </span>Google Workspace Business or Enterprise subscription
- <span> </span>Super Admin access required

##### **<span style="font-family:SimSun;">Required Roles &amp; Permissions</span>**

##### **<span style="font-family:SimSun;">Microsoft 365</span>**

The administrator performing the migration requires:

- <span> </span>Exchange Administrator  
    or
- Global Administrator

##### **<span style="font-family:SimSun;">Google Workspace</span>**

The administrator requires:

- <span> </span>Super Admin role

##### **<span style="font-family:SimSun;">Dependencies</span>**

The following services must be accessible:

- <span> </span>Exchange Online
- <span> </span>Google Workspace Admin Console
- <span> </span>Google Cloud Console

##### **<span style="font-family:SimSun;">Preparation Tasks</span>**

Before beginning:

- Create Microsoft 365 mailboxes for all users being migrated
- Verify domains in Microsoft 365
- <span> </span>Ensure users have Exchange Online licenses assigned
- <span> </span>Confirm mailbox sizes and available storage
- <span> </span>Plan migration window and user communication

##### **<span style="font-family:SimSun;">Step 1: Configure Google Cloud Service Account</span>**

##### **<span style="font-family:SimSun;">Create Google Cloud Project</span>**

Navigate to:

<span class="15">[https://console.cloud.google.com/](https://console.cloud.google.com/)</span>

Create a new project.

Example:

*<span class="15">M365Migration</span>*

##### **<span style="font-family:SimSun;">Create Service Account</span>**

Navigate to:

*<span class="15">IAM &amp; Admin → Service Accounts</span>*

Select:

*<span class="15">Create Service Account</span>*

Example service account name:

*<span class="15">exchange-migration</span>*

Select:

- Create
- Done

##### **<span style="font-family:SimSun;">Enable Domain-Wide Delegation</span>**

Open the newly created service account.

Navigate to:

*<span class="15">Details &gt; Show Domain-wide Delegation</span>*

Enable:

*<span class="15">Enable Google Workspace Domain-wide Delegation</span>*

Enter a product name:

*<span class="15">Exchange Migration</span>*

Save the configuration.

##### **<span style="font-family:SimSun;">Record the Client ID</span>**

Within the service account:

- Copy the Unique ID / Client ID
- Save it securely

This ID will later be used for delegated access configuration.

##### **<span style="font-family:SimSun;">Create JSON Key</span>**

Navigate to:

<span class="15">Keys &gt; Add Key &gt; Create New Key</span>

Select

- JSON

Download and securely store the JSON key file.

<p class="callout warning"><span style="font-family:SimSun;">Treat this file as sensitive credential material.</span></p>

##### **<span style="font-family:SimSun;">Step 2: Configure Google Workspace Delegated Access</span>**

Navigate to:

*<span class="15">Google Admin Console &gt; Security &gt; Access and Data Control &gt; API Controls</span>*

Select:

*<span class="15">Manage Domain Wide Delegation</span>*

Select:

*<span class="15">Add New</span>*

##### **<span style="font-family:SimSun;">Configure Delegated Access</span>**

##### **<span style="font-family:SimSun;">Client ID</span>**

Paste the service account Client ID copied earlier.

##### **<span style="font-family:SimSun;">OAuth Scopes</span>**

Enter the following scopes exactly as shown:

*<span class="15">https://mail.google.com/,https://www.googleapis.com/auth/calendar,https://www.google.com/m8/feeds/,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/contacts</span>*

<p class="callout warning"><span style="font-family:SimSun;">Important:</span></p>

- Do not add spaces
- Use comma-separated format only
- Incorrect scopes will cause migration failures later

Select:

*<span class="15">Authorize</span>*

##### **<span style="font-family:SimSun;">Step 3 — Enable Required Google APIs</span>**

In the Project page, navigate to:

[https://console.cloud.google.com/apis/library](https://console.cloud.google.com/apis/library)

Ensure the correct migration project is selected.

Click Enable API Services and enable the following APIs:

<table id="bkmrk-api-required-gmail-a" style="border-collapse:collapse;width:41.6667%;height:280px;"><colgroup><col style="width:53.8338%;"></col><col style="width:46.1662%;"></col></colgroup><tbody><tr><td>**API**

</td><td>**Required**

</td></tr><tr><td>Gmail API

</td><td>Yes

</td></tr><tr><td>Google Calendar API

</td><td>Yes

</td></tr><tr><td>Contacts API

</td><td>Yes

</td></tr><tr><td>People API

</td><td>Yes

</td></tr></tbody></table>

##### **<span style="font-family:SimSun;">Step 4: Configure Migration Endpoint in Exchange Online</span>**

Navigate to:

<span class="15">Exch*ange Admin Center &gt; Migration*</span>

Select:

*<span class="15">Add Migration Batch</span>*

##### **<span style="font-family:SimSun;">Migration Path</span>**

Choose:

*<span class="15">Google Workspace (Gmail)</span>*

##### **<span style="font-family:SimSun;">Migration Endpoint Configuration</span>**

##### **<span style="font-family:SimSun;">Email Address</span>**

Enter a Google Workspace Super Admin account.

Example:

*<span class="15">admin@company.com</span>*

<p class="callout warning"><span style="font-family:SimSun;">Do not use the service account email address.</span></p>

##### **<span style="font-family:SimSun;">JSON Key File</span>**

Upload the downloaded JSON key file created earlier.

##### **<span style="font-family:SimSun;">Verification</span>**

If endpoint validation repeatedly fails:

- Enable Skip Verification
- Continue with pilot migration testing

<p class="callout info"><span style="font-family:SimSun;">Google propagation delays may cause temporary validation failures.</span></p>

##### **<span style="font-family:SimSun;">Step 5: Access Control / Enforcement</span>**

##### **<span style="font-family:SimSun;">Recommended Migration Scope</span>**

For production safety:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Begin with pilot users only
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Avoid immediate tenant-wide migration

Recommended pilot group:

- IT administrators
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Test users
- <span> </span>Low-risk business users

##### **<span style="font-family:SimSun;">Recommended Mail Flow Strategy</span>**

During migration:

- Keep Google Workspace as primary mail delivery platform
- <span> </span>Do not switch MX records immediately

Switch MX records only after:

- <span> </span>Mailbox validation
- <span> </span>User acceptance testing
- <span> </span>Successful pilot migration completion

##### **<span style="font-family:SimSun;">Step 6: Testing / Report Mode</span>**

##### **<span style="font-family:SimSun;">Recommended Pilot Migration Process</span>**

Migrate:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>One mailbox initially
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Validate data integrity
- <span> </span>Confirm permissions and access

##### **<span style="font-family:SimSun;">Validate Migrated Data</span>**

Confirm:

- <span> </span>Emails migrated successfully
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Folder structure preserved
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Calendar items imported
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Contacts available
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Outlook access functional

**<span style="font-family:SimSun;">User Validation</span>**

Perform:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Outlook sign-in testing
- <span><span style="font:7pt 'Times New Roman';"> </span></span>OWA testing
- Mobile device testing

##### **<span style="font-family:SimSun;">Step 7: Monitoring &amp; Validation</span>**

##### **<span style="font-family:SimSun;">Exchange Online Monitoring</span>**

Navigate to:

<span class="15">Exchange Admin Center &gt; Migration</span>

Monitor:

- <span> </span>Batch status
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Sync progress
- <span> </span>Failed items
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Skipped items

##### **<span style="font-family:SimSun;">Google Workspace Validation</span>**

Validate:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>API access remains active
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Service account remains enabled
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Delegation settings remain configured

##### **<span style="font-family:SimSun;">Common Issues to Monitor</span>**

<table id="bkmrk-issue-likely-cause-e" style="border-collapse:collapse;width:55.3571%;"><colgroup><col style="width:46.1411%;"></col><col style="width:53.8589%;"></col></colgroup><tbody><tr><td>**Issue**

</td><td>**Likely Cause**

</td></tr><tr><td>Endpoint validation failure

</td><td>Propagation delay

</td></tr><tr><td>Authentication failure

</td><td>Incorrect OAuth scopes

</td></tr><tr><td>Mailbox sync failure

</td><td>API not enabled

</td></tr><tr><td>Permission denied

</td><td>Delegation not configured

</td></tr><tr><td>Rate limiting

</td><td>Excessive retry attempts

</td></tr></tbody></table>

##### **<span style="font-family:SimSun;">Step 8: Enforcement / Go-Live</span>**

Once migration validation is complete:

##### **<span style="font-family:SimSun;">Finalize Migration</span>**

Complete:

- Final synchronization
- User sign-off
- <span> </span>Mail flow cutover

##### **<span style="font-family:SimSun;">Update MX Records</span>**

Point MX records to Microsoft 365.

Example Microsoft MX target:

*<span class="15">&lt;tenant&gt;.mail.protection.outlook.com</span>*

##### **<span style="font-family:SimSun;">Post-Cutover Tasks</span>**

Perform:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Outlook profile validation
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Mobile device reconfiguration
- <span><span style="font:7pt 'Times New Roman';"> </span></span>DNS validation
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Mail flow testing

##### **<span style="font-family:SimSun;">Important Considerations</span>**

##### **<span style="font-family:SimSun;">Propagation Delays</span>**

Google delegation and API changes may take:

- 15 minutes to 24 hours

Temporary failures during this period are expected.

##### **<span style="font-family:SimSun;">Service Account Security</span>**

The JSON key file provides privileged access.

Recommendations:

- <span> </span>Store securely
- <span> </span>Restrict administrator access
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Delete unused keys after migration

##### **<span style="font-family:SimSun;">Verification Failures</span>**

Microsoft endpoint verification may intermittently fail even when configuration is correct.

Where necessary:

- <span><span style="font:7pt 'Times New Roman';"> </span><span style="font:7pt 'Times New Roman';"> </span></span>Use Skip Verification
- <span> </span>Validate with pilot migrations

##### **<span style="font-family:SimSun;">Large Mailboxes</span>**

Large Gmail mailboxes may:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Take several hours
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Experience throttling
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Require staged synchronization

##### **<span style="font-family:SimSun;">Best Practices</span>**

##### **<span style="font-family:SimSun;">Security Recommendations</span>**

- <span> </span>Use dedicated migration admin accounts
- <span><span style="font:7pt 'Times New Roman';"> </span><span style="font:7pt 'Times New Roman';"> </span></span>Restrict service account access
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Remove unused delegation after migration completion
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Rotate or delete JSON keys post-migration

##### **<span style="font-family:SimSun;">Operational Recommendations</span>**

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Start with pilot users
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Avoid weekend cutovers without validation
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Maintain rollback capability during migration
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Document all DNS changes

##### **<span style="font-family:SimSun;">Migration Recommendations</span>**

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Migrate mailboxes in batches
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Validate each batch before proceeding
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Communicate migration timelines clearly to users

##### **<span style="font-family:SimSun;">Summary</span>**

This implementation configured secure mailbox migration from Google Workspace to Exchange Online using Microsoft’s built-in Google Workspace migration functionality.

The process included:

- <span><span style="font:7pt 'Times New Roman';"> </span></span>Google Cloud service account creation
- API enablement
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Domain-wide delegation
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Exchange Online migration endpoint configuration
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Pilot migration validation
- <span><span style="font:7pt 'Times New Roman';"> </span></span>Controlled production rollout

Following this approach provides a secure, enterprise-ready migration process while minimising disruption, authentication issues, and mailbox migration failures.