MigrationFox Documentation

MigrationFox migrates files, SharePoint sites, Teams channels, Slack channels, and mailboxes across 13 platforms, from the cloud or from MigrationFox Desktop on your Windows PC. It also archives InfoPath forms to searchable PDFs and runs read-only Microsoft 365 assessments for tenants preparing a Copilot rollout. Start free with 2 GB of migration credit.

Supported Platforms

How It Works

Every migration follows five steps:

Quick Start Guide

Get your first migration running in a few steps.

Creating a Project

A project is the top-level container for a migration effort. It holds your connections, scan results, provisioning, and every migration you run in it.

Project Settings

Project Lifecycle

The project tabs follow the usual stages:

1. Connect: add source and destination connections
2. Discover: scan the source to see what's there
3. Provision: optionally create destination sites, libraries, teams, Shared Drives, buckets, or folders
4. Migrate: transfer files and metadata
5. History: review results, retry failed files, and download reports

Understanding the Workflow

Every migration follows the same five phases.

Phase 1: Connect

Connect your source and destination platforms. Depending on the platform, that's an OAuth sign-in (for example Sign in with Microsoft), admin consent, a service account or your own app registration, or access keys. Stored credentials are encrypted with AES-256-GCM.

Phase 2: Discover

The Discover tab scans the source and shows:

• Folder, file, and total size counts, and last-modified dates
• A folder table with direct and total files, size, and subfolders (downloadable as CSV)
• Optionally, folder permissions and Microsoft 365 group membership (Include permissions, which makes the scan take longer)

A migration's page also has a Pre-Migration Analysis (files that will transfer or be skipped, oversized files, unsupported types, duplicate paths) and a file type breakdown.

Phase 3: Provision

The Provision tab can create the destination structure before you migrate: SharePoint sites, libraries, and folders; Teams teams and channels; Google Shared Drives; S3 buckets; and folders on the other platforms.

Phase 4: Migrate

The data transfer. Runs from MigrationFox Desktop on your PC send files straight from source to destination. Cloud runs stream files through the MigrationFox worker (on Oracle Cloud) and don't store them after the migration. Files are transferred in parallel, with parallelism tuned per platform, and large files use chunked uploads.

Phase 5: Monitor

Track progress live on the migration's page:

• Files transferred, skipped, and failed
• Transfer speed and an estimated time remaining
• Per-file status with the error or skip reason
• A live log you can export

The Activity page keeps a workspace-wide audit log.

Google Drive / Google Workspace

Migrate files and folders to or from Google Drive, including My Drive and Shared Drives, for one user or across a Google Workspace organization.

Prerequisites

• For one user's content: a Google account you can sign in with (OAuth 2.0)
• For organization-wide access: a Google Cloud project with the Google Drive API enabled, a service account, and a Google Workspace admin to authorize domain-wide delegation

Required Permissions / Scopes

This is the scope you authorize for a service account's domain-wide delegation. It grants read/write access to Drive files. The OAuth 2.0 sign-in also asks for Gmail access, which MigrationFox uses only for mail migration.

Service Account Setup (Recommended)

A service account with domain-wide delegation gives organization-wide access without each user signing in.

OAuth Setup (Alternative)

Signing in is quicker to set up but only reaches the content the signed-in user can access.

1. On the Connect tab, choose Google Drive → OAuth 2.0 (in Desktop: Sign in)
2. Sign in with your Google account and allow access

Both options see the Shared Drives the signed-in (or impersonated) user is a member of.

Supported Features

SharePoint / OneDrive

Migrate files, document libraries, lists, and site content to or from SharePoint Online and OneDrive for Business.

Prerequisites

• A Microsoft 365 tenant with SharePoint Online
• A work account that can reach the content. Depending on your tenant's consent settings, an admin may need to approve the MigrationFox app the first time

Required Permissions

Sign in with Microsoft (the default) asks for these delegated permissions on the MigrationFox app (a Microsoft Verified Publisher app):

Access is limited to what the signed-in user can reach. True History (original authors, dates, and versions) needs a Sign in with Microsoft destination plus a one-time admin consent for SharePoint access; that page has the steps.

Sign in with Microsoft (Default)

Your Own App Registration (Advanced)

If your organization requires its own Entra ID app, SharePoint supports a Service Account connection (OneDrive connections use sign-in only):

1. In the Entra admin center, go to App registrations → New registration. Choose Accounts in this organizational directory only and click Register.
2. Under API permissions → Microsoft Graph → Application permissions, add Sites.ReadWrite.All and Files.ReadWrite.All (add Sites.FullControl.All if MigrationFox will create sites). Click Grant admin consent.
3. Under Certificates & secrets, create a client secret and copy its Value right away; it's shown only once.
4. In MigrationFox, choose SharePoint → Service Account and enter the Azure Tenant ID, Application (Client) ID, and Client Secret, then click Add & Validate.

Client secrets only; certificate authentication isn't supported.

Supported Features

Microsoft Teams

Migrate Teams channels, messages, replies, members, and channel files between Microsoft Teams tenants, from Slack to Teams, or from Teams to Google Chat. Start from the Teams & chat tile on the Migrate tab.

Prerequisites

• A Global Administrator of the Microsoft 365 tenant, to approve the MigrationFox Teams app once
• Or, as an alternative, your own Entra ID app registration

Required Permissions

Application permissions requested by the MigrationFox Teams app:

Setup

Supported Features

Slack

Migrate Slack channels, threads, and files to Microsoft Teams.

Prerequisites

• A Slack app with a bot token
• Workspace Admin or Owner permissions (to install the app)

Required Bot Token Scopes

Setup

Supported Features

AWS S3

Migrate files to or from Amazon S3 buckets. Also works with S3-compatible storage such as MinIO, Wasabi, and Backblaze B2.

Prerequisites

• An AWS account with an IAM user that has S3 access
• The bucket name and region

Required IAM Permissions

At minimum, the IAM user needs these S3 permissions. You can use the managed AmazonS3FullAccess policy or a custom policy like this one:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

Setup

Supported Features

S3-Compatible Storage

MigrationFox works with S3-compatible storage when you set a custom endpoint:

SFTP

Migrate files to or from servers over SFTP (SSH File Transfer Protocol). In the app this platform is listed as "SFTP / FTP", but only SFTP is supported; plain FTP isn't.

Prerequisites

• SSH access to the server
• An account with read access (source) or write access (destination) to the target directory

Setup

sftp username@your-server.com

sftp -i /path/to/key username@your-server.com

Supported Features

Dropbox

Migrate files and folders to or from Dropbox, for the account you connect (personal or a Dropbox Business member account).

Prerequisites

• A Dropbox account to sign in with
• Or, for the access-token option, a Dropbox developer app

Required Scopes

For the access-token option, your Dropbox app needs:

Setup

Supported Features

Box

Migrate files, folders, and folder collaborations to or from Box, for one user or, as a Box admin, for many users at once.

Prerequisites

• A Box account to sign in with
• To browse and migrate other users' content: a Box admin, or a co-admin with "Manage users"

Setup

Supported Features

SMB / Windows File Shares

Migrate files from on-premises Windows file servers, network shares (UNC paths), and local folders using MigrationFox Desktop, the Windows app. Desktop runs the migration on your PC, so files go straight from the share to the destination.

Prerequisites

• A Windows PC or server with network access to the file share
• MigrationFox Desktop, signed in to your MigrationFox account. No administrator rights needed
• Read access to the share for the Windows account that runs the migration

How It Works

On-premises file shares aren't reachable from the internet, so the migration runs on a PC inside your network. MigrationFox Desktop installs without admin rights ("Only for me"), runs as you, and reads file shares with your own Windows account. Migrations keep running while you're signed in to Windows, even with the screen locked. MigrationFox sees status, counts, file names and paths, and errors; file contents go straight from source to destination.

Run Options

• Runs while signed in (default): Desktop runs migrations as the signed-in user.
• Background mode (optional): in Desktop's Settings, turn on Background mode (one admin prompt). Migrations then run as a Windows service, keep going with nobody signed in and after restarts, and read file shares as the computer account, so grant that account read access to the share.
• PowerShell: Desktop includes the MigrationFox PowerShell module for scripted and bulk runs (see Setup step 4).

There's no separate server agent to install anymore; MigrationFox Desktop replaces it.

Setup

\\fileserver\shared\documents

Import-Module MigrationFox
Connect-MigrationFox
Start-MFMigration -SourcePath '\\fileserver\Departments\HR' `
    -DestinationSiteUrl 'https://contoso.sharepoint.com/sites/HR' `
    -DestinationLibrary 'Documents' | Wait-MFMigration

SMB to Cloud Direct Upload

Desktop uploads files directly from the share to the cloud destination; they don't pass through MigrationFox's servers. This means:

• Direct path: data goes from your network to the cloud provider
• Parallel uploads: several files upload at once, tuned to the destination's limits
• No copies kept: files are streamed, not stored by MigrationFox

Supported Features

Azure Blob Storage

Migrate files to or from Azure Blob Storage containers, using the storage account's access key.

Prerequisites

• An Azure Storage Account with at least one container
• The storage account name and an access key

Setup

Supported Features

InfoPath PDF Archive

What It Does

InfoPath PDF Archive turns InfoPath form submissions (XML) into searchable PDFs, one per submission. Files attached inside a form are restored as the original files next to the PDF, and each run writes a CSV index (opens in Excel) listing every submission, its PDF, its attachments, and its field values. The original XML stays where it is; nothing is deleted.

Source Options

• SharePoint form library (SharePoint Online): runs in the cloud. Connect with Microsoft, pick the site and form library, and pick a destination document library.
• A folder of submissions: XML files on a PC, a file share, or exported from SharePoint Server (on-premises). Run this from the MigrationFox Windows app (Migrate → InfoPath archive, source Folder on this PC). The output can go to SharePoint/cloud storage or to a local folder or file share.

How the SharePoint Online Path Works

1. You connect the SharePoint tenant that hosts the form library (source) and the tenant for the destination; most customers use the same connection for both.
2. The wizard shows the lists on the site that have an InfoPath template; you pick one form library per run.
3. For each submission, MigrationFox reads the field values and renders a searchable PDF with field labels and values.
4. The PDFs go into an InfoPath Archive folder in the destination library, one subfolder per submission holding the PDF and any attachments. The CSV index goes in the InfoPath Archive folder.
5. A submission that can't be read is logged as failed and the run continues with the rest.

Prerequisites

• A SharePoint connection in your project with read access to the form library and write access to the destination library.
• Form credits: one credit per submission converted (see Pricing below). Runs from the Windows app on a PC covered by MigrationFox Pro don't use form credits, and the Windows app's free 14-day trial covers up to 100 forms.

Step-by-Step Setup

Pricing

InfoPath PDF Archive is billed per form (submission) converted, not by GB: CA$0.25 per form, or CA$0.15 per form when you buy 10,000 or more. Form credits never expire. Buy them on the Billing page under InfoPath PDF Archive. Runs from the Windows app on a PC covered by MigrationFox Pro are included in that license (from Desktop 0.6.24, the forms are turned into PDFs on that PC). See pricing.

If your balance runs out during a run, MigrationFox converts as many forms as you have credits for and the run log shows how many remain, so check your balance before a large run. To see what the output looks like first, preview one form free.

Output Format

Each submission becomes one searchable PDF with:

• Field labels: taken from the form template where available; otherwise derived from the XML element names, with SharePoint encoding (_x0020_ → space) decoded and camelCase split into words.
• Field values: as text; rich-text fields have HTML removed, dropdown codes are shown as their display text where the template defines them, and dates are formatted. Empty fields are left out.
• Attachments: listed in the PDF and saved as the original files next to it.
• SharePoint system fields (ContentType, FileLeafRef, compliance tags, and similar) are left out of the PDF.
• File names: based on the submission's title, its date, and a short ID (for example Budget-request_2025-03-14_a1b2c3.pdf).

Mail Migration

Supported Platforms

1. Microsoft 365 (Exchange Online) mailboxes, via Microsoft Graph
2. Gmail (Google Workspace) mailboxes, via the Gmail API

Either can be the source or the destination. On-premises Exchange and IMAP aren't offered.

Features

• Mailbox selection: Just my own mailbox, Pick users from my tenant (with Auto-match of source to destination users), or Paste / CSV mapping (sourceEmail,destEmail).
• Folder Filter: migrate only the folders you list (for example Inbox, Sent Items).
• From Date / To Date: migrate only messages within a date window.
• Attachments: during the beta, attachment copying is switched on per platform, so check with us before a run that needs attachments, and open a few migrated messages to confirm they came across.
• Bulk with user mapping: see Bulk mail migration with user mapping for the CSV format, Gmail service-account and domain-wide delegation setup, and the Microsoft 365 Mail.ReadWrite application permission.
• Connections for many mailboxes: Microsoft 365 uses Multiple users in my tenant (the MigrationFox Mail app, admin consent) or your own Azure app; Gmail uses a Workspace service account with domain-wide delegation. See Mail Migration: Service-Account Setup.

Mail migration runs in the web app; it isn't in the Windows app.

M365 Assessment Suite

What It Does

The M365 Assessment Suite is a family of six read-only Microsoft Graph assessments, found under Governance in the MigrationFox app. Each produces a 1.0 to 4.0 composite score, a prioritized list of findings with stable IDs, and recommendations. The in-app estimate for a typical tenant is about 3 to 5 minutes per run; large tenants take longer.

6 Assessment Products

1. Copilot Readiness Assessment: whether your tenant is safe to enable Microsoft 365 Copilot, and what to fix first. Includes the SharePoint Advanced Management (SAM) module.
2. Microsoft 365 Complete Assessment: every module in one scan, including Power Platform. Available only with Tenant Suite or Consultant Pro; not sold on its own and not part of the free snapshot.
3. SharePoint and OneDrive Assessment: oversharing audit, "Anyone" link inventory, external sharing posture, ownership gaps, OneDrive governance.
4. Teams Assessment: Teams lifecycle and governance (orphaned teams, owner counts, guests, external sharing).
5. M365 Security Assessment: Conditional Access, MFA coverage, Global Admin count, guest ratio, Purview labels, audit readiness.
6. Power Platform Assessment: license inventory, service principals, OAuth grants, plus manual-verification links for environments, connector DLP, premium usage, and gateways.

Assessment Modules & 100+ Checks

Findings come from ten modules with more than 100 distinct check IDs. Each product runs the relevant subset: Copilot Readiness runs eight modules, the Microsoft 365 Complete Assessment runs nine (adding Power Platform), and the focused products run two or three each. See Assessment Modules.

The 1.0 to 4.0 Score

The composite score is a weighted average across the modules that ran (Apps Readiness is weighted 2×; Purview and Copilot Configuration 1.5×; the rest 1×). Every score lands in one of four bands:

• 1.0 to 1.9: NOT_READY (red). Critical gaps in data protection, oversharing, or identity. Don't enable Copilot, even for a pilot, until the "Must Do Before Copilot" items are resolved.
• 2.0 to 2.9: PARTIALLY_READY (orange). Run a tightly scoped pilot with a handful of hand-picked users on non-sensitive workloads only. Address all "Must Do Before Copilot" items before broadening.
• 3.0 to 3.4: MOSTLY_READY (yellow). An internal pilot is reasonable. Resolve the remaining "Must Do Before Full Rollout" items before expanding to all users.
• 3.5 to 4.0: READY (green). Full rollout is reasonable. Keep re-assessing periodically to catch drift.

Setup & Required Scopes

Assessments connect to your Microsoft 365 tenant through the read-only MigrationFox Assessment app. The default is to sign in with an admin account and consent; no app registration is needed. Using your own Azure app registration (a "Service Account" connection) is the advanced option.

The Read-Only Graph Scopes

The base set is 15 read-only Microsoft Graph permissions, all requiring admin consent. None of them grant write access.

• Sites.Read.All: SharePoint sites and permission settings
• Files.Read.All: OneDrive and SharePoint files (oversharing scan)
• User.Read.All: user profiles, license assignments, Copilot eligibility
• Group.Read.All: Microsoft 365 groups and Teams membership
• Directory.Read.All: tenant directory and roles
• AuditLog.Read.All: audit log readiness
• InformationProtectionPolicy.Read.All: sensitivity labels and policies (tenant-wide)
• Policy.Read.All: Conditional Access and authentication policies
• Reports.Read.All: Microsoft 365 usage and adoption reports
• SecurityEvents.Read.All: identity protection and security events
• TeamSettings.Read.All: Teams configuration and policies
• DelegatedPermissionGrant.Read.All: OAuth grants, for risky-app detection
• Application.Read.All: app registrations, for overprivileged-app detection
• SharePointTenantSettings.Read.All: tenant-wide SharePoint sharing settings
• RecordsManagement.Read.All: retention labels and records management

Some deeper modules use a few more permissions: Sites.FullControl.All (SharePoint Advanced Management, to read per-site access-control state that Graph only exposes under that permission), Team.ReadBasic.All, TeamMember.Read.All and Channel.ReadBasic.All (Teams), and RoleManagement.Read.Directory and IdentityRiskyUser.Read.All (Identity). If one is missing, the affected checks are marked unverified instead of failing the run.

Four of the base permissions (AuditLog.Read.All, InformationProtectionPolicy.Read.All, Reports.Read.All, DelegatedPermissionGrant.Read.All) exist only as application permissions. With a Connect with Microsoft connection, checks that need them are marked unverified; a Service Account connection covers them.

Step-by-Step Setup

Running an Assessment

From Governance, click + Run New Assessment. Choose the product (Copilot Readiness, SharePoint and OneDrive, Teams, M365 Security, Power Platform, or Microsoft 365 Complete if you have Tenant Suite or Consultant Pro), choose the tenant connection, and click Run Assessment →.

Live Progress

The page shows progress for each module as it scans. If a check can't be verified (a missing permission, or an endpoint that returns an error), it's marked unverified and the scan continues. One module's problem doesn't stop the overall run.

Re-runs

Paid purchases allow unlimited re-runs while the purchase is active (90 days for a single assessment, 1 year for Tenant Suite and Consultant Pro). The free snapshot is limited to one run per MigrationFox account every 30 days. Each run produces a fresh score and findings, so you can track progress over time from the score trend on the Governance page.

Reading the Report

When the assessment completes, the results page shows the score banner, the module scorecard, and then the findings (paid) or one sample finding (free snapshot).

Hero Score Banner

The composite score (1.0 to 4.0) with the color-coded four-state verdict, the guidance for that verdict, the target tenant, and the assessment date. Export buttons appear here for paid purchases; the free snapshot shows "Free Snapshot: view only" instead.

Module Scorecard

One row per module with its score (1 to 4), label, and finding count. Modules with unverified checks are noted. The scorecard is visible to everyone, including the free snapshot.

Finding Priorities

Each finding is tagged with one of three priorities:

• Must Do Before Copilot: blockers. Don't enable Copilot until these are resolved.
• Must Do Before Full Rollout: a pilot is reasonable, but a wider rollout needs these closed first.
• Nice to Have: improvements that don't block Copilot but strengthen your long-term posture.

Each finding has a stable ID (for example SAM-004 or ID-003), an observation, the business impact, a recommendation, the responsible role, an effort estimate, and a Microsoft documentation link.

DLP Coverage for Copilot

Data Loss Prevention coverage for Copilot is one of the most important things to confirm before a rollout: if your DLP policies protect SharePoint, OneDrive, Teams, and Exchange but not Copilot, Copilot can still surface that content. Microsoft Graph doesn't expose DLP policies for reading, so the assessment raises this as a manual-verify item (in the Copilot Configuration module) with the steps to check it in the Purview portal, rather than inspecting your DLP policies directly.

Stored Results

Assessment results are stored in MigrationFox, encrypted at rest, so you can track readiness over time and re-open reports. You can delete an assessment from the Governance page at any time.

Assessment Modules

Every finding belongs to a module, and each module has a stable ID prefix. These are the modules the six products run today.

1. Licensing & Infrastructure (LIC)

Subscribed SKUs, base plan detection (E3, E5, Business Premium), add-ons such as Copilot, Purview, and Entra ID P1/P2, and service health. Answers: do you have the licenses the features you want require?

2. Purview (PD)

Sensitivity labels, retention labels, and information protection settings that Graph exposes. Policy areas Graph can't read (such as DLP policy contents) are raised as manual-verify findings with steps.

3. Identity & Access (ID)

Conditional Access policies, MFA coverage, guest ratio, privileged roles, risky users, OAuth grant sprawl, and applications with broad permissions such as Mail.ReadWrite or Files.ReadWrite.All.

4. Apps Readiness (APP)

Microsoft 365 Apps update channels across the tenant. Copilot in the desktop apps needs Current Channel or Monthly Enterprise Channel, so this module shows how much upgrade work there is.

5. Teams (TD) and OneDrive (OD)

Teams: lifecycle hygiene (stale and ownerless teams), guests, external access, and channel inventory. OneDrive: per-account sharing, orphaned drives, storage governance, and OneDrive policy settings.

6. SharePoint Advanced Management (SAM)

Tenant and site sharing defaults, "Anyone" link settings, site access controls, and the SharePoint settings Microsoft's Copilot readiness checklist calls out. The free snapshot samples up to 30 sites; paid runs read up to 200. Settings that are only available through SharePoint PowerShell are raised as manual-verify findings.

7. Power Platform (PP, PPD) and Copilot Configuration (COP)

Power Platform: license inventory, service principals, OAuth grants, and manual-verification links for environments, connector DLP, premium connector usage, and on-premises gateways. Copilot Configuration: Copilot license use, audit presence, sensitivity-label enforcement, and manual-verify items for Restricted SharePoint Search, Copilot admin settings, and DLP for Copilot.

SharePoint Restructuring Wizard

The Restructuring Wizard (Governance → Restructuring Wizard) analyzes a SharePoint site and proposes a plan to split an overgrown site into properly scoped sites. It requires an active governance purchase.

What It Analyzes

• Permission fragmentation: broken inheritance on libraries and top-level folders (checked at the library and top-level folder level, not per file)
• Storage concentration: storage consumed per library, to find hot spots
• Stale content: libraries with no activity in 90+ days
• Large lists: libraries over the 5,000-item list view threshold
• Item count: libraries with more than 100,000 items, heading toward SharePoint's limits
• Folder sprawl: many deeply nested folders that suggest independent content areas

Health Score

Each site gets a health score from 1 to 10 (10 is healthiest; each issue lowers it by its severity). A site is flagged for restructuring when it has two or more unique permission boundaries or any high-severity issue.

Editable plan (the architect's planner)

The proposed plan is editable before execution. Rename proposed sites and target libraries, move libraries between sites with Move to another site, remove sites (their libraries return to the primary site), or add empty sites with + Add empty site. A per-site Structure only (empty site) option and a global Skip content migration checkbox provision the new sites with empty libraries, which helps when content will move in a later change window. The plan can also be exported as CSV.

Source tree with Promote

Alongside the generated plan, a Source Tree view shows the site's libraries and folders as an expandable hierarchy. Every library and folder has a Promote → button that spins it off as its own target site. Promoting a folder copies only that sub-tree into a new library; the rest of the parent library is untouched. See Folder restructuring for the full walkthrough.

Execution

Click Execute Restructuring, then Confirm & Execute. The wizard creates the new sites (created as team sites today) and, unless the plan is structure only, queues MigrationFox migration jobs to copy content from the original site into the new ones. The original site isn't changed.

OneDrive Cleanup Wizard

The OneDrive Cleanup Wizard analyzes up to 100 licensed users' OneDrives and sorts what it finds into five categories. It's analysis only: it doesn't change anything in your tenant. It requires an active governance purchase.

5 Issue Categories

1. Oversized: OneDrives using more than 80% of their quota
2. Stale Account: no file changes in 12+ months
3. External Sharing: OneDrives with active external sharing
4. Departed User: OneDrives belonging to disabled or deleted accounts
5. Orphan Content: content with no active owner

Export

Click Export CSV to download the results for remediation planning or your IT service management tool. Fixes are applied by your team; the wizard doesn't apply them.

Continuous Monitoring

With monitoring on, MigrationFox re-runs your last assessment about every 30 days, compares it with the previous run, and emails you the comparison.

Comparison Report

The email includes:

• New findings: issues that appeared since the last run
• Resolved findings: issues no longer detected
• Score change: the change in composite score, with a trend arrow

Exports (PDF / Word / Excel / HTML / CSV / JSON)

Any active paid purchase unlocks exports. The free snapshot is view-only and has no exports.

Export Formats

• PDF Report: the full report. With Tenant Suite or Consultant Pro, the PDF is white-label (your logo, no MigrationFox branding); with a single assessment it's MigrationFox-branded.
• Word Report (.docx): an editable report for adding commentary before delivery. White-label with Tenant Suite or Consultant Pro.
• Excel Data (.xlsx): summary, module scorecard, action plan, and per-module sheets.
• HTML Report: a self-contained HTML file with inline CSS and no external resources, for an intranet or an email attachment.
• Action Plan CSV: Microsoft Planner import format, one task per finding, bucketed by module.
• Raw JSON: all findings, the action plan, module results, and metadata, for scripts or ticketing tools.

You can also create a read-only Share Link to a report (30 days by default, up to 90).

Pricing & Tiers

The M365 Assessment Suite is priced separately from migration credits. Every option is a one-time payment with no subscription, no auto-renew, and no per-user fee. Current prices are on the pricing page.

Free Snapshot: CA$0

One assessment every 30 days per MigrationFox account, for any one of the five individually sold products (the Microsoft 365 Complete Assessment isn't included). View-only: the composite score, the four-state verdict, the module scorecard with finding counts, and one sample finding in the same format as paid reports. No exports, and no email or webhook on completion.

Single Assessment: CA$99 one-time

One product (Copilot Readiness, Power Platform, SharePoint and OneDrive, Teams, or M365 Security) with 90 days of access and unlimited re-runs, locked to one Microsoft 365 tenant at the first scan. Full findings, all export formats, MigrationFox-branded PDF and Word reports.

Tenant Suite: CA$399 one-time

All six assessments, including the Microsoft 365 Complete Assessment, plus the governance tools (Restructuring Wizard, OneDrive Cleanup, Bulk Provisioning, Continuous Monitoring and more) for one Microsoft 365 tenant, with 1 year of access. Includes white-label PDF and Word reports and a commercial redistribution license, so you can deliver the report to a client as your own work product.

Consultant Pro: CA$1,599 one-time, 1 year

Everything in Tenant Suite for one named consultant, across unlimited client tenants, with white-label reports and the commercial redistribution license on every report.

Per-tenant lock

Single assessments and Tenant Suite are locked to the first Microsoft 365 tenant you scan with them. Scans against a different tenant are blocked, so an MSP scanning ten client tenants needs ten purchases (or Consultant Pro).

Full pricing and FAQ on the Microsoft 365 Assessment Suite page.

API & Webhooks

These are the endpoints the MigrationFox web app uses for assessments, under https://api.migrationfox.com/api/v1. They authenticate with your signed-in app session; there are no personal API tokens today. Access rules are enforced on the server: export endpoints return 402 with paid_tier_required without an active paid purchase.

Endpoints

Webhook Event: governance.assessment.completed

If you've set a webhook URL (Billing → Webhook notifications), MigrationFox sends governance.assessment.completed (or governance.assessment.failed) when a paid assessment finishes. Free snapshot runs don't send webhooks. The same webhook URL receives migration events; switch on the X-MigrationFox-Event header.

Webhook Payload Example

{
  "event": "governance.assessment.completed",
  "assessmentId": "cmnxxx...",
  "tenantId": "ten_xxx...",
  "label": "Q1 Readiness Scan",
  "targetTenantId": "<M365 tenant GUID>",
  "targetTenantName": "Contoso Ltd.",
  "status": "COMPLETED",
  "overallScore": 2.8,
  "pilotState": "PARTIALLY_READY",
  "totalFindings": 14,
  "mustDoBeforeCopilot": 5,
  "durationMs": 198432,
  "timestamp": "2026-04-11T15:30:42.123Z"
}

When you set a webhook secret, an HMAC-SHA256 signature is sent in X-MigrationFox-Signature (sha256=<hex>). The headers match migration webhooks: X-MigrationFox-Event, X-MigrationFox-Delivery, and X-MigrationFox-Signature.

Email Delivery

For paid assessments, MigrationFox also emails a summary when each assessment completes: the score, the verdict, the finding counts, the top 3 "Must Do Before Copilot" actions, and a link back to the report. Free snapshot runs don't send emails.

Discovery / Scanning

Before migrating, you can scan the source to see what's there. This is the project's Discover tab.

Running a Discovery Scan

1. Make sure the project has a source connection (Connect tab)
2. On the Discover tab, choose the connection and path, then click ⌕ Scan (for a file share on a PC, ⌕ Create Scan Job)
3. Optionally tick Include permissions to collect folder permissions and Microsoft 365 group membership (the scan takes several times longer)
4. Small sources finish in minutes; sources with millions of files can take hours

Discovery Report

The scan shows:

• Folders, Files, Total Size, Last Modified, and scan time
• A folder table with direct files, total files, total size, last modified, and subfolders, downloadable as CSV
• Permissions, when Include permissions is on

Each migration's page also has a Pre-Migration Analysis (files that will transfer or be skipped, oversized files, unsupported types, and duplicate paths), a File Type Breakdown, and pre-flight checks such as long paths.

Selective Migration

In the wizard's Choose content step you can migrate everything or pick specific folders or libraries. This is useful for phased migrations or leaving out content you don't need.

Provisioning

Provisioning creates destination containers (sites, libraries, teams, drives, buckets, folders) before you migrate. It's the project's Provision tab.

What Gets Provisioned

How to Use

1. Optionally run a scan to review the source structure first
2. Open the Provision tab and pick what to create (for example Create Site or Create Shared Drive)
3. Fill in the details and confirm
4. Start the migration and choose the new container as the destination

Migration Modes

The wizard's Transfer Mode decides what happens to the source and which files are copied.

The Incremental option under If file already exists at destination works the same way for files that already exist: they're replaced only when the source is newer.

Folder Mapping

Folder Mapping Rules (in the wizard's Options step) rewrite source paths to different destination paths. Use them when the destination is organized differently from the source.

How It Works

Each rule maps a source path to a destination path. Rules are checked in order and the first match wins:

Source Path                    →  Destination Path
/Marketing/2024/Campaigns/*   →  /Departments/Marketing/Campaigns-2024/*
/Engineering/Docs/*           →  /Technical/Documentation/*
/Shared/Photos                →  /Media Library/Photos

Mapping Rules

• Prefix with wildcard (/OldDept/* → /Archive/2024/OldDept/*): everything under the source folder goes under the destination folder
• Path prefix: a folder path without * also maps that folder and everything beneath it
• Click + Add mapping rule for each rule

To leave folders out, pick only the folders you want in Choose content or use Exclude File Types; there's no flatten or skip rule type.

Conflict Resolution

When a file with the same name already exists at the destination, MigrationFox follows the If file already exists at destination option you chose.

Permission Migration

With Migrate permissions on (the default), MigrationFox copies file and folder sharing from the source to the destination where both platforms support it.

How Permissions Are Mapped

People are matched by email address. If a user has access on the source (for example Google Drive sharing), MigrationFox shares the item with the same user at the destination, provided that user exists there. For cross-tenant moves, add a User mapping CSV (sourceEmail,destEmail); when a mapping is set, users not in it are left out.

Permissions are applied on SharePoint, OneDrive, Google Drive, Box, and Dropbox destinations (Dropbox: users with an email address). S3, Azure Blob, SFTP, and file shares have no user sharing to apply. NTFS (file share) permissions aren't migrated.

Permission Mapping Matrix

Bandwidth Throttling

MigrationFox manages transfer speed for you. There's no bandwidth or concurrency setting in the wizard today.

Configuration

• Parallel transfers are tuned per source and destination pair, based on each platform's limits (for example, fewer parallel writes to SharePoint than to Google Drive).
• Platform throttling: when Microsoft or Google rate-limits requests, MigrationFox waits the time the service asks for (Retry-After) and slows down, then recovers automatically.
• Off-hours runs: to keep load off business hours, use Schedule for later.

Scheduling

Schedule a migration to start at a specific time, for example during off-peak hours.

How to Schedule

In the wizard's Review step, tick Schedule for later and choose a date and time (at least 5 minutes ahead). The migration is queued and starts automatically at that time; its page shows the scheduled time.

Scheduling Options

• Immediate: start right away (default)
• One-time schedule: run once at a specific date and time
• Recurring schedules aren't available; to repeat a sync pass, start or schedule another run

API Reference

There are no personal API keys or a public REST API for general use today. To script migrations, use the MigrationFox PowerShell module, which is included with MigrationFox Desktop and uses its sign-in.

Authentication

Install MigrationFox Desktop on the Windows PC and sign in, then:

Import-Module MigrationFox
Connect-MigrationFox

On a machine without a Desktop sign-in, create a sign-in token on the web app's Devices page and pass it with Connect-MigrationFox -Token (Read-Host -AsSecureString). Works on Windows PowerShell 5.1 and PowerShell 7+.

Base URL

https://api.migrationfox.com/api/v1

The module talks to this API for you; you don't call it directly.

Endpoints (Preview)

Webhooks

Get an HTTP POST when a migration finishes.

Supported Events

Configuration

On the Billing page, find Webhook notifications and enter:

• URL: your endpoint that receives the POST requests
• Signing secret (optional): used to sign each payload with HMAC-SHA256, sent as X-MigrationFox-Signature: sha256=<hex>

Click Save, then Send test to send a sample job.completed. One webhook URL applies to your whole workspace. Each event is sent once (10-second timeout, no retries), so treat webhooks as notifications and check the migration's status in the app if one is missed.

Payload Example

{
  "event": "job.completed",
  "jobId": "cmxxxxxxxx",
  "tenantId": "cmyyyyyyyy",
  "label": "HR share to SharePoint",
  "status": "COMPLETED",
  "mode": "COPY",
  "filesTransferred": 15420,
  "filesFailed": 3,
  "bytesTransferred": "52428800000",
  "timestamp": "2026-03-24T15:30:00.000Z"
}

Headers: X-MigrationFox-Event (the event name), X-MigrationFox-Delivery (the migration ID), and X-MigrationFox-Signature when a secret is set.

Troubleshooting

Common errors and their solutions.

Still Need Help?

If your issue isn't listed above:

• Check the migration's page for per-file errors and skip reasons, and export its log
• Review the Activity page for your workspace's audit log
• In MigrationFox Desktop, use Report a problem to send diagnostics to support
• Contact support at support@migrationfox.com

Security

How MigrationFox handles your data and credentials. MigrationFox doesn't hold SOC 2 or ISO 27001 certification today.

Data Handling Summary