BOX TO SHAREPOINT ONLINE MIGRATION PLAN

SharePoint Mentor Curated Articles

Box to SharePoint Online Migration Plan - 12-Month Phased Architecture, Wave Schedule, & Execution Blueprint

1. Executive Summary & Wave Rollout Strategy

This document defines the enterprise architecture, operational roadmap, and governance model for migrating 125 users and associated content from Box to Microsoft SharePoint Online and OneDrive for Business. Executed over a 12-month period from November 2026 through November 2027, the initiative transitions the organization from legacy cloud storage to an integrated Microsoft 365 collaboration ecosystem.

Core Objectives

  • Data Sovereignty & Security: Standardize information architecture on SharePoint Online, utilizing Microsoft Purview for automated labeling, Data Loss Prevention (DLP), and conditional access.
  • Minimal Business Disruption: Employ a 4-wave rollout structure grouped by department operational dependencies, limiting downtime to a single delta cutover window per wave.
  • AI Readiness: Establish clean directory permissions and structured metadata prior to enabling Microsoft 365 Copilot, preventing oversharing via semantic search.
  • Cost Optimization: Completely decommission the enterprise Box tenant by late November 2027 to eliminate duplicate licensing costs.

Wave Execution Strategy

The 125 users and ~8.5 TB of active content are partitioned across four distinct migration waves. Each wave undergoes a structured 90-day lifecycle: Discovery & Mapping, Pre-Migration & Dry Run, Final Delta Sync & Cutover, and Post-Migration Hypercare.

  • Wave 0 (Pilot & Core IT): Technical proof-of-concept, automated engine configuration, baseline governance, and IT validation.
  • Wave 1 (Administrative Core): Structured repositories with strict permission boundaries (HR and Finance).
  • Wave 2 (Operations & Commercial): High-volume, active working repositories (Operations, Project Delivery, Sales, Marketing).
  • Wave 3 (Executive & Cross-Functional): Highly sensitive, business-critical assets and final legacy archive conversion (Executive, Legal, Cross-Functional).

2. Migration Wave Breakdown

3. 12-Month Master Schedule & Timeline

Month 1: November 2026 — Architecture & Discovery

  • Provision Microsoft Migration Tool (MMT) / Sharegate infrastructure.
  • Run initial Box tenant discovery scans to identify file count, depth, long paths, and invalid characters.
  • Establish SharePoint Online Hub Site hierarchy and site provisioning templates.

Month 2: December 2026 — Governance & Pilot Staging

  • Finalize Security & Compliance policies (M365 Sensitivity Labels, Retention Schedules).
  • Stage Wave 0 data structures and map Box enterprise permissions to Entra ID (Azure AD) groups.
  • Conduct initial dry-run migration for Wave 0.

Month 3: January 2027 — Wave 0 Cutover & Refinement

  • Execute final delta cutover for Wave 0 (IT & Pilot group).
  • Validate external sharing parameters and automated sync workflows.
  • Refine migration throughput settings and user communication playbooks based on pilot metrics.

Month 4: February 2027 — Wave 1 Discovery & Scanning

  • Initiate deep-scan of HR and Finance Box folders.
  • Remediate permissions (convert direct folder shares to Entra ID role-based access).
  • Distribute Wave 1 end-user change management communications.

Month 5: March 2027 — Wave 1 Staging & Pre-Migration

  • Execute full initial copy of HR and Finance data to target SharePoint libraries.
  • Conduct validation checks on sensitive document metadata and version histories.
  • Run Champion-led training sessions for HR and Finance staff.

Month 6: April 2027 — Wave 1 Cutover & Wave 2 Prep

  • Execute Wave 1 delta cutover; set Wave 1 Box folders to Read-Only.
  • Transition HR and Finance users to SharePoint Online and OneDrive.
  • Launch Wave 2 discovery scans across Operations, Sales, and Marketing repositories.

Month 7: May 2027 — Wave 2 Pre-Migration & Mapping

  • Pre-provision Departmental Hub Sites and Project Team Libraries for Wave 2.
  • Begin initial data seed for Operations, Project Delivery, Sales, and Marketing (4.0 TB).
  • Execute path-length remediation for deep project directory structures.

Month 8: June 2027 — Wave 2 Mid-Point Sync & User Readiness

  • Run incremental synchronization passes for Wave 2 data.
  • Deliver tailored training on co-authoring, Teams file integration, and OneDrive sync client.
  • Conduct pre-cutover operational readiness review with department leads.

Month 9: July 2027 — Wave 2 Cutover & Wave 3 Prep

  • Execute Wave 2 delta cutover over a scheduled weekend window.
  • Switch Wave 2 Box repositories to Read-Only; verify file integrity in SharePoint.
  • Initiate discovery and security mapping for Wave 3 (Executive & Legal).

Month 10: August 2027 — Wave 3 Staging & Governance Hardening

  • Stage Executive and Legal files into high-security SharePoint site collections.
  • Implement Restricted SharePoint Search policies and explicit access controls.
  • Execute initial data seed for Wave 3 repositories (2.5 TB).

Month 11: September 2027 — Wave 3 Delta Sync & Final Cutover Prep

  • Perform incremental data updates for Wave 3.
  • Finalize cross-functional archival data structures.
  • Execute enterprise-wide communication regarding impending Box tenant lockdown.

Month 12: October 2027 — Wave 3 Cutover & Enterprise Cutover

  • Execute final Wave 3 delta cutover; seal all operational Box folders across the enterprise.
  • Transition Executive and Legal teams to secure SharePoint sites.
  • Complete final global verification of all migrated data.

Post-Migration: November 2027 — Box Tenant Decommission

  • Export Box audit logs, admin reports, and permission matrices for regulatory archives.
  • Place Box tenant into full administrative read-only lock.
  • Terminate Box enterprise subscription and complete transition to M365 steady-state.

4. Phased Milestone Execution Checklist

Phase 1: Architecture, Governance & Infrastructure Setup (Months 1–2)

  • Complete Box enterprise metadata and directory scanning.
  • Define M365 Information Architecture (Hubs, Site Collections, Libraries).
  • Configure Microsoft Purview Sensitivity Labels and Data Loss Prevention rules.
  • Deploy and configure preferred migration engine nodes (MMT / Sharegate).
  • Create Entra ID security groups corresponding to Box folder access levels.

Phase 2: Wave 0 Execution & Technical Validation (Months 2–3)

  • Perform initial full copy pass for Wave 0 (0.5 TB).
  • Execute Wave 0 delta sync and set Box target paths to Read-Only.
  • Validate file hashes, version history retention, and metadata fidelity.
  • Conduct post-migration survey with IT pilot cohort; refine process parameters.

Phase 3: Wave 1 Execution — Administrative Core (Months 4–6)

  • Perform deep scans and path length remediation for HR & Finance libraries.
  • Execute full background sync pass for Wave 1 data (1.5 TB).
  • Complete UAT with HR and Finance business leads.
  • Execute final delta sync, lock Box HR/Finance paths, and cut over users.
  • Deliver targeted training on handling PII/PHI in secure SharePoint libraries.

Phase 4: Wave 2 Execution — Operations & Commercial (Months 6–9)

  • Pre-provision departmental Hub Sites and Teams-linked document libraries.
  • Execute initial bulk copy pass for 4.0 TB of active operational data.
  • Perform bi-weekly incremental delta syncs to minimize final cutover duration.
  • Conduct user training on OneDrive Sync, Teams integration, and co-authoring.
  • Finalize weekend delta cutover; restrict Wave 2 Box access to Read-Only.

Phase 5: Wave 3 Execution — Executive, Legal & Final Cutover (Months 9–12)

  • Configure encrypted site collections with Restricted SharePoint Search enabled.
  • Seed 2.5 TB of Executive, Legal, and legacy archival content into target sites.
  • Execute final incremental sync for Wave 3.
  • Conduct final cutover pass; transition all remaining users to SharePoint Online.
  • Verify complete data parity between Box source and SharePoint destination.

Phase 6: Decommissioning & Steady-State Operations (Month 12+)

  • Complete administrative export of Box system logs and historical permissions.
  • Revoke user licenses and place Box tenant in a frozen, read-only state.
  • Perform final tenant cancellation with Box account management.
  • Transition support operations to M365 Steady-State Managed Services team.

5. Governance, Training & Post-Migration Safeguards

To prevent sprawl, data exposure, and operational degradation following the migration, the following technical and operational safeguards must be enforced across the Microsoft 365 tenant.

M365 Group & Site Lifecycle Policy

  • Expiration Policies: Implement an automated 180-day inactivity renewal policy for Microsoft 365 Groups tied to SharePoint sites. Group owners receive automated renewal prompts; unrenewed groups are soft-deleted after 30 days of inactivity.
  • Provisioning Controls: Disable self-service site creation for end users. All new SharePoint sites must be requested through a centralized IT service catalog form enforcing metadata tagging (Department, Business Owner, Data Classification).

Restricted SharePoint Search & Over-Sharing Protection

To prevent accidental exposure of sensitive content via enterprise search or AI interfaces:

  • Restricted SharePoint Search (RSS): Enable RSS tenant-wide during the migration phase to cap search indexing to explicitly allowed site collections while permissions are normalized.
  • Access Reviews: Configure quarterly Entra ID Access Reviews for all site collections classified as Confidential or Highly Confidential.
  • External Sharing Scoping: Limit external sharing to specific domain allow-lists. Disable "Anyone with the link" (anonymous) sharing links enterprise-wide; enforce "Specific people" links with mandatory expiration dates (maximum 30 days).

Microsoft 365 Copilot Readiness

Prior to activating Microsoft 365 Copilot across migrated repositories:

  • Data Hygiene & Permissions Auditing: Utilize Microsoft Purview Information Protection to scan for legacy "Open Access" files (e.g., content accessible to Everyone except external users).
  • Sensitivity Label Enforcements: Automatically apply Confidential sensitivity labels to libraries containing financial, legal, or employee personal data, excluding them from broad Copilot semantic index summaries where appropriate.

Box Tenant Decommissioning Protocol

  1. Access Revocation: On November 1, 2027, revoke all non-admin SSO access to Box via Entra ID Enterprise Applications.
  2. Read-Only Freeze: Retain a 30-day administrative read-only window for IT Global Admins to address unforeseen edge-case missing file requests.
  3. Log & Metadata Retention: Download all historical Box activity logs, user permission matrices, and system reports to a secure compliance archive library in SharePoint.
  4. Contract Termination: Process formal contract termination and tenant deletion with Box by November 30, 2027, ensuring complete purge of source tenant data.

«