Before you begin with the data migration service

To use the data migration service, you must meet the following requirements:

Where you can migrate from

Legacy environment Data you can migrate with the data migration service
  • Microsoft Office 365™
  • Exchange 2016
  • Exchange 2013
  • Exchange 2010
  • Exchange 2007

Calendar events
Calendar resources

  • IBM® Domino®
  • Exchange 2003 or earlier
  • Webmail providers, such as Yahoo!®
  • Consumer Gmail account
  • An existing G Suite account
  • Other IMAP server 

Set up your new G Suite domain

If you have the legacy free edition of G Suite, upgrade to G Suite Basic to get this feature. 

  • Ensure that each person has a user account in your new G Suite domain. The data migration service only migrates data to accounts of existing G Suite users. The migration doesn't create G Suite users from the data it migrates. For information on how to create G Suite user accounts, see Options for adding users.
  • The target Google service must be enabled for the user:
    • Gmail must be enabled for mail migration.
    • Contacts must be enabled for contact migration.
    • Calendar must be enabled for calendar migration.

    For details, see Control who can access Google services.

  • Before your users start to use their Google products or services, they must have a user license. See How licensing works for details. 
Important information for Resellers
Resellers are not able to migrate data on behalf of their customers via the Reseller console. Migrations must be performed using the customer's Admin console.

Set up your TLS (SSL) certificates

The data migration service communicates over Transport Layer Security (TLS) and requires your legacy environment to have a TLS certificate.

Note: TLS and its predecessor, SSL (Secure Sockets Layer), are often both referred to as "SSL." 

The certificate must be signed and trusted by a third-party root certificate authority. You can't use the data migration service if your email server has a self-signed certificate.

Set up your certificate

Use a TLS certificate verifier to verify the installation and signing of the TLS certificate. If the TLS certificate is not trusted, the certificate verifier displays a warning message. If the TLS certificate is trusted, the certificate verifier displays a successful connection message with details about the TLS certificate and trusted Internet root authority.

Note: If you are checking the certificate of an IMAP server, specify port 993 in the verifier. For example,


When you create your certificate, we recommend that you:

  • Change the default size of your key ring from 512 to 2048 bits.
  • Complete optional fields, like city or locality, when you create your key ring. Some certificate authorities require this information.
  • Install a trusted root and an intermediate certificate into the key ring before you merge your actual certificate if your certificate authority provides both types of certificates.

Set up your legacy environment

Click your environment below for more setup steps:

Office 365 or Microsoft Exchange 2007 or later

Before you migrate from Office 365, Exchange 2007, Exchange 2010,  Exchange 2013, or Exchange 2016 you must:

We also recommend that you:

  • Test your Exchange server connectivity with the Microsoft Remote Connectivity Analyzer.
  • If you are an Exchange user, verify the EWS setup and point a browser to the EWS URL. If the EWS setup is correct, your browser displays a sign-in page.
  • Verify your impersonation rights in Office 365. When migrating from Office 365, the Admin console prompts you to enter the username and password of your Office 365 role account. That account must have impersonation rights in Office 365 for all the email accounts you want to migrate. We recommend you use the administrator account, which has impersonation rights by default. If you use another account, first add it to the Organization Management role group in Office 365 to give it impersonation rights before you start a migration. See your Office 365 documentation for more information.
  • Ensure your server is able to receive connections from Google IP address ranges.
  • Verify your UPN. You may need to modify the UPN if you see an authentication error.
IMAP server

Before you migrate from Exchange 2003 or earlier, webmail providers, or other IMAP servers, you must:

Choose a role account: When migrating from an IMAP webmail server, the Admin console prompts you to enter the username and password of your legacy environment role account. This is an account on your mail server. The data migration service uses it to test connectivity to your mail server.  

Set up your SSL certificates: The data migration service can migrate email from SSL-enabled email accounts on Internet-accessible IMAP servers. 

  • If you run your own IMAP server, install a valid SSL certificate from a trusted certificate authority. (See SSL certificates prerequisites.)
  • If your email is hosted by an Internet Service Provider, enable SSL for the accounts you want to migrate.

Google IP address ranges: Ensure your server is able to receive connections from Google IP address ranges.

If required, see the additional prerequisites for migrations from IBM Domino and Gmail.

Gmail consumer account

The data migration service uses IMAP to migrate email from consumer Gmail accounts (accounts that end with or You need to enable IMAP access to any accounts before migrating. 

Enable the following settings in Gmail:

  1. Sign in to Gmail.
  2. Click in the top corner and select Settings.
    1. Click Forwarding and POP/IMAP:
      1. Select Enable IMAP.
      2. Under Folder size limits, select Do not limit the number of messages in an IMAP folder (default).
      3. Click Save changes.
    2. Click Labels and ensure that any label that needs to be migrated has the Show in IMAP box checked. 

In addition to enabling IMAP access, Gmail users need to allow the data migration service access to their accounts. For details, see Migrate from Gmail to G Suite.

Existing G Suite account

Before you migrate from an existing G Suite account, you must:

  • In your old G Suite account, ensure that access by a less secure app is permitted for all users. For instructions, see Enforcing access to less secure apps for all users. We recommend that you disable less secure apps once the migration is complete.
  • You need to Turn IMAP on for users to any accounts. 
  • If you have 2-Step Verification or Single Sign-On (SSO) enabled, you need to generate an app password for the data migration service. You'll use it later in the Google Admin console when you are migrating mail. 
  • Ask your users to turn on the following settings in Gmail:
    1. Sign in to Gmail.
    2. Click Settings Settings in the top corner and select Settings.
    3. Click Forwarding and POP/IMAP, then under Folder size limits, select Do not limit the number of messages in an IMAP folder (default)
    4. Click Save changes.
    5. Click Labels and ensure that any label that needs to be migrated has the Show in IMAP box checked. 
IBM Domino

The data migration service can only migrate email from an IBM Domino IMAP server.

If you don't currently use the IMAP server built into IBM Domino, you must complete the steps below before using the data migration service.

  • The data migration service works with IBM Domino version 8.5.2 and later. Migrations from other versions of Domino usually work, but Google only supports migrations from version 8.5.2.
  • The data migration service doesn't migrate draft or encrypted email.
  • The data migration service only migrates email from IBM Domino. If you want to migrate contacts, calendar resources, or other Domino data, use G Suite Migration for IBM® Notes® (GSMIN).
  • These instructions provide a general outline of IBM Domino procedures. For more information, see your IBM Domino documentation.

Step 1. Prepare your mail files and users for IMAP access

  1. In the Person Document for each user whose mail you want to migrate, do the following:
    • Set the Format preference for incoming mail to Prefers MIME. This offers the best fidelity and performance for IMAP clients.
    • Ensure that everyone you want to migrate has an Internet password set in their Person document. The data migration service and Domino IMAP service use these passwords for authentication.
  2. Enable IBM Notes views for IMAP and folder synchronization.
  3. Run the Domino Compact and Fixup tasks against your mail databases. This ensures that the On Disk Structure is correct for each database and also verifies the integrity of the mail prior to the conversion process.
  4. Run the mail conversion utility (the Convert task) to enable IMAP-specific features in each mail database. The conversion utility sets an option bit in the database indicating that the database is IMAP-enabled.
  5. Run the conversion utility a second time using the -h option. This adds IMAP attributes to messages that were already in the mail database at the time of the initial conversion.
  6. After the conversion process completes, verify the “Database is IMAP enabled” message appears in the database properties.

Step 2. Obtain and install a third-party TLS (SSL) certificate

The data migration service must have HTTPS access to your legacy server; it does not support HTTP. Refer to this IBM Technote to set up TLS using a third-party certificate authority on your Domino server for migrations from IBM Domino.

Step 3. Enable and start the Domino IMAP server

  1. To open the the mail server's configuration document in the Domino directory, click MIME > Conversion Options > Outbound. In the Message content field, select from Notes to HTML. This ensures the correct formatting of Notes for the data migration service.
  2. To open your Server document in the Domino directory, click Ports > Internet Ports > Mail, and enable the IMAP service on both the TCP/IP and SSL ports.

    Note: Ensure that your firewall allows traffic to flow on ports 143 and 993.

  3. If the IMAP service does not load automatically when you start your Domino server, open your server console and enter the Load IMAP command to load the IMAP server.
  4. Run a test migration.


Next steps

When you've met the requirements above, migrate email or contact and calendars.  

Was this article helpful?
How can we improve it?