A defensible SharePoint Online migration runs through eight phases: Discovery, Assessment, Planning, Pre-Migration, Migration Execution, Cut-over, Post-Migration, and Adoption - each with specific checklist items that map to the common failure modes.
This guide gives the full phase-by-phase checklist for US mid-market and enterprise organizations migrating from SharePoint Server (2013, 2016, 2019, Subscription Edition) or other content systems to SharePoint Online.
It is opinionated about which items are non-negotiable and which are situational, and it cross-references the deeper guides in this cluster where a single line is not enough. It is written for US IT leaders, CIOs, program managers, infrastructure architects, and SharePoint administrators running or evaluating a SharePoint Online migration.
Phase 1 - Discovery Checklist
Discovery sets the program up to make defensible decisions. Items at this phase are about people and intent, not technology.
- Confirm executive sponsor and steering committee membership.
- Identify business-unit stakeholders for each major SharePoint workload.
- Document the business outcomes the migration is expected to deliver.
- Confirm the cloud strategy commitment to Microsoft 365 and SharePoint Online.
- Establish the high-level timeline window and major constraints.
- Identify security and compliance leads who will sign off at gates.
- Confirm the partner or internal team owning the program.
Phase 2 - Assessment Checklist
Assessment converts assumptions about the source environment into evidence. The detailed walkthrough is in the dedicated assessment guide; the checklist items here are the minimum.
- Site and content inventory (sites, libraries, lists, item counts, storage volume).
- Permissions audit (unique permissions, broken inheritance, external sharing).
- Customization inventory (full-trust solutions, SPFx extensions, classic workflows, InfoPath).
- Integration inventory (Salesforce, Dynamics, Teams, Power BI , ServiceNow, SAP, Workday, DocuSign, LOB).
- External sharing audit (current external sharing, target policy).
- Compliance and records audit (retention, eDiscovery, legal holds).
- Storage and quota analysis (target tenant quota, multi-geo decisions).
- Identity readiness check (AD to Entra ID, group structure, conditional access).
Phase 3 - Planning Checklist
Planning translates assessment evidence into a defensible migration design.
- Target architecture (sites, hubs, Microsoft 365 groups, Teams alignment).
- Tooling selection (SPMT, Migration Manager, ShareGate, AvePoint, Quest, Metalogix) fit to source.
- Migration wave design (which content moves in which wave, in what order).
- Customization remediation plan (rebuild in SPFx, Power Apps, Power Automate, or retire).
- Integration sequencing plan (which integrations cut over with which waves).
- Change management plan (champions network, training, communication cadence).
- Security and compliance plan (Microsoft Purview labels, DLP, retention).
- Risk-prioritization framework with named owners for each top risk.
Phase 4 - Pre-Migration Checklist
Pre-migration prepares the target environment and the people who will use it.
- Target tenant configured (Entra ID app registrations, conditional access, MFA).
- Target SharePoint Online sites provisioned with chosen architecture.
- Custom content types, site columns, and term store entries created in target.
- Microsoft Purview sensitivity labels and DLP policies deployed to target.
- Customization rebuilds in pilot (SPFx, Power Apps, Power Automate).
- Identity mapping validated on a sample of users.
- Pilot migration wave executed and verified.
- Change management cadence started (executive comms, champions training).
Phase 5 - Migration Execution Checklist
Execution moves production content into the target in planned waves.
- Production waves scheduled with named business-unit owners.
- Migration tool batches sized for throttling limits.
- Wave-level verification (item counts, sample checksums, permissions, metadata).
- Error log review and remediation cadence (not skipped under time pressure).
- Wave-level UAT by content owners.
- Integration cutover sequencing per wave.
- Communication to affected users at each wave.
- Source environment kept read-only on a defined retention schedule.
Phase 6 - Cut-Over Checklist
Cut-over is where the production source becomes read-only and the target becomes authoritative for a workload or wave.
- Cutover window scheduled and communicated.
- Final delta sync executed and verified.
- DNS, hard-coded URLs, and dependent system pointers updated.
- Integration endpoints switched to the target.
- Permissions verified on a sample of users at the new home.
- Rollback path documented and ready (usually source-read-only fallback).
- Help-desk staffing increased for the cutover window.
Phase 7 - Post-Migration Checklist
Post-migration stabilizes the new home and closes the source environment cleanly.
- Post-cutover monitoring for performance and error rates.
- Issue log triage cadence for early user reports.
- Permissions and external sharing audit in the new home.
- Microsoft Purview policy verification (labels, retention, DLP).
- Integration verification post-cutover.
- Source environment retirement plan executed on schedule.
- Lessons learned captured for subsequent waves.
Phase 8 - Adoption Checklist
Adoption is what turns a successful technical migration into business value.
- Role-based training delivered to each business unit.
- Champions network active with regular cadence.
- Self-service learning content available and discoverable.
- Executive communication of the new way of working.
- Usage and adoption metrics tracked (Microsoft 365 admin center reports).
- Continuous improvement backlog for post-migration enhancements.
- Microsoft 365 Copilot and SharePoint Premium readiness assessed.
How to Use This Checklist?
The checklist is opinionated but adaptable. For a small mid-market migration, some items collapse into single workstreams; for a large-enterprise multi-wave program, items expand into named workstreams with their own sub-checklists. The discipline is: every phase has an owner, every item has a definition of done, every risk has a named mitigation. Centric runs this checklist inside its SharePoint migration & integration practice, as part of the broader Centric SharePoint consulting practice. General guidance, not legal or compliance advice; consult counsel and your security function on the compliance items.
Frequently Asked Questions
Where should we start with this checklist?
Phase 1 (Discovery), even if the team has already had informal migration conversations. Discovery sets the executive sponsorship and stakeholder map that the rest of the program depends on.
How long should we spend in each phase?
Phase length varies with environment complexity. The migration-timing guide in this cluster gives realistic ranges for each phase.
Can we skip the pre-migration assessment?
Almost never advisable. The assessment is where assumptions become evidence; programs that skip it usually re-do the work later under time pressure.
Who owns the checklist?
The program manager owns the checklist overall; each phase has a named owner; each item has a named accountable role. Single-owner programs almost always miss items.
Does the checklist change for hybrid migrations?
Yes - hybrid adds items about identity federation, search federation, and operational complexity. The hybrid post in this cluster covers the specific additions.
How do we track checklist progress for executive reporting?
Most enterprise programs track progress in a project portfolio tool (often inside Microsoft 365 - Project, Planner, or Lists in SharePoint Online) with monthly executive dashboard reviews.
What if we are partway into the program already?
Start at the current phase but walk back through prior phases to confirm nothing material was skipped. Closing those gaps now is cheaper than discovering them at cutover.
Conclusion
A SharePoint Online migration that runs through these eight phases with named owners and defined completion criteria is structurally more likely to land on time, on budget, and with adoption that delivers the business outcomes the program was approved for. The checklist is not the work; the discipline of working through the checklist is.
