MigrationFox Documentation

Supported Platforms

How It Works

Every migration follows five core steps:

Quick Start Guide

Get your first migration running in just a few steps.

Creating a Project

A project is the top-level container for a migration. Each project has its own source connection, destination connection, discovery data, and migration jobs.

Project Settings

Project Lifecycle

A project goes through these stages:

1. Setup — Connect source and destination, configure credentials
2. Discovery — Scan the source to build a file inventory
3. Provisioning — Optionally pre-create destination structure (sites, libraries, folders)
4. Migration — Transfer files and metadata
5. Verification — Review results, re-run for any failed items

Understanding the Workflow

Every migration in MigrationFox follows a five-phase workflow. Understanding each phase helps you plan and execute migrations efficiently.

Phase 1: Connect

Authenticate with your source and destination platforms. MigrationFox supports OAuth (interactive login), service accounts (for unattended access), and API keys depending on the platform. Credentials are encrypted with AES-256 and stored securely.

Phase 2: Discover

Discovery scans your source environment and builds a complete inventory of files, folders, and metadata. The discovery report shows:

• Total file count and size
• Folder tree structure
• File type distribution
• Large files that may need special handling
• Permission mappings

Phase 3: Provision

Before migrating data, MigrationFox can pre-create the destination structure. For SharePoint, this means creating site collections, document libraries, and folders. For Google Drive, this means creating Shared Drives and folder hierarchies. Provisioning ensures the destination is ready to receive data.

Phase 4: Migrate

The actual data transfer. MigrationFox streams files directly from source to destination without storing data on its own servers. Files are transferred in parallel with configurable concurrency. Large files use chunked/multipart uploads for reliability.

Phase 5: Monitor

Track migration progress in real time. The dashboard shows:

• Files transferred / remaining / failed
• Transfer speed (MB/s)
• Estimated time remaining
• Per-file status with error details
• Audit log of all operations

Google Drive / Google Workspace

Migrate files and folders to or from Google Drive, including personal drives, Shared Drives (Team Drives), and domain-wide content for Google Workspace organizations.

Prerequisites

• A Google Cloud project with the Google Drive API enabled
• For organization-wide access: a Google Workspace admin account (for domain-wide delegation)
• Either a service account (recommended for production) or an OAuth 2.0 client

Required Permissions / Scopes

This scope grants full read/write access to Google Drive files. For read-only source access, you can use drive.readonly instead.

Service Account Setup (Recommended)

Service accounts provide unattended, organization-wide access without requiring individual user authentication.

OAuth Setup (Alternative)

OAuth is simpler to set up but requires interactive user login and only accesses that user's content.

1. In Google Cloud Console, go to Credentials → Create Credentials → OAuth Client ID
2. Application type: Web application
3. Add your MigrationFox redirect URI: https://app.migrationfox.com/auth/google/callback
4. Note the Client ID and Client Secret
5. In MigrationFox, choose OAuth authentication and click Connect with Google

Supported Features

SharePoint / OneDrive

Migrate files, document libraries, and site content to or from SharePoint Online and OneDrive for Business.

Prerequisites

• An Azure AD (Entra ID) app registration
• A Microsoft 365 tenant with SharePoint Online
• Global Admin or SharePoint Admin permissions (for granting consent)

Required Permissions

For Application (app-only, unattended) access:

App Registration Setup

OAuth Setup (Delegated Access)

For delegated access (user-specific), add Delegated permissions instead of Application permissions, add your redirect URI (https://app.migrationfox.com/auth/microsoft/callback), and use the OAuth flow in MigrationFox.

Supported Features

Microsoft Teams

Migrate Teams channels, messages, replies, reactions, and member lists between Microsoft Teams tenants, or from Slack to Teams.

Prerequisites

• An Azure AD app registration (can be the same as your SharePoint registration, or separate)
• Teams Administrator permissions for granting consent

Required Permissions

Setup

Supported Features

Slack

Migrate Slack channels, messages, threads, reactions, and file attachments to Microsoft Teams.

Prerequisites

• A Slack app with a bot token
• Workspace Admin or Owner permissions (for installing the app)

Required Bot Token Scopes

Setup

Supported Features

AWS S3

Migrate files to or from Amazon S3 buckets. Also works with S3-compatible storage providers like MinIO, Wasabi, and Backblaze B2.

Prerequisites

• An AWS account with an IAM user or role that has S3 access
• The bucket name and region

Required IAM Permissions

At minimum, your IAM user needs the following S3 permissions. You can use the managed AmazonS3FullAccess policy or create a custom policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

Setup

Supported Features

S3-Compatible Storage

MigrationFox works with any S3-compatible storage by specifying a custom endpoint:

SFTP / FTP

Migrate files to or from remote servers using SFTP (SSH File Transfer Protocol) or FTP.

Prerequisites

• SSH access to the server (for SFTP) or FTP credentials
• The user account must have read access (source) or write access (destination) to the target directory

Setup

sftp username@your-server.com

sftp -i /path/to/key.pem username@your-server.com

Supported Features

Dropbox

Migrate files and folders to or from Dropbox, including personal and business accounts.

Prerequisites

• A Dropbox developer app
• For business accounts: Dropbox Business admin access

Required Scopes

Setup

Supported Features

Box

Migrate files, folders, and collaborations to or from Box.

Prerequisites

• A Box developer app (Custom App)
• For enterprise access: Box Admin authorization

Setup

Supported Features

SMB / Windows File Shares

Migrate files from on-premises Windows file servers and network shares (UNC paths) using the MigrationFox Windows Agent.

Prerequisites

• A Windows machine with network access to the file share
• Administrator privileges on the machine (for running the agent)
• An active MigrationFox project with an agent token

How It Works

Unlike cloud-to-cloud migrations, on-premises file shares are not accessible from the internet. The MigrationFox Windows Agent runs on a machine inside your network, connects outbound to MigrationFox, and handles local file access securely.

Agent Options

The MigrationFox Agent is available in two formats:

• migrationfox-agent.exe — Standalone Windows executable, no dependencies required
• migrationfox-agent.ps1 — PowerShell script, useful for environments where .exe files are restricted by policy

Setup

migrationfox-agent.exe --token YOUR_AGENT_TOKEN

.\migrationfox-agent.ps1 -Token YOUR_AGENT_TOKEN

\\fileserver\shared\documents

SMB to Cloud Direct Upload

The agent uploads files directly from the local file share to the cloud destination without routing data through the MigrationFox API server. This means:

• Faster transfers — data goes directly from your network to the cloud provider
• 5 parallel uploads — the agent runs up to 5 concurrent file uploads for maximum throughput
• No data stored — files are streamed directly, never written to intermediate storage

Supported Features

Azure Blob Storage

Migrate files to or from Azure Blob Storage containers. Supports any storage account with access key or SAS token authentication.

Prerequisites

• An Azure Storage Account with at least one container
• The account name and an access key (or a SAS token with read/write permissions)

Setup

Supported Features

InfoPath PDF Archive

What It Does

InfoPath PDF Archive converts InfoPath XML form submissions into formatted, searchable PDF documents and uploads them to a SharePoint Online document library. This preserves your form data in a universally readable format before InfoPath is retired.

How It Works

1. The MigrationFox Agent connects to your on-premises SharePoint server via NTLM authentication
2. Downloads the XSN template (form definition) and all XML submissions from the InfoPath form library
3. Extracts field definitions and labels from the XSN template manifest
4. Generates a formatted PDF document for each XML submission, with field names and values laid out in a readable table format
5. Uploads the generated PDFs to a SharePoint Online document library in your destination tenant

Prerequisites

• The MigrationFox Windows Agent installed on a machine with network access to the on-premises SharePoint server
• NTLM credentials (domain\username and password) with read access to the InfoPath form library
• A SharePoint Online destination configured in your MigrationFox project (for uploading the generated PDFs)
• The on-premises SharePoint server must be accessible from the machine running the agent (typically on the same network or via VPN)

Step-by-Step Setup

migrationfox-agent.exe --token YOUR_AGENT_TOKEN

.\migrationfox-agent.ps1 -Token YOUR_AGENT_TOKEN

Output Format

Each InfoPath submission is converted to a PDF with:

• Form title and submission date in the header
• Field labels extracted from the XSN template
• Field values from the XML submission
• A clean, tabular layout suitable for printing and archiving
• File naming convention: FormName_SubmissionDate_ID.pdf

Mail Migration

Supported Platforms

1. Gmail — Google Workspace mailboxes via Gmail API
2. Office 365 — Exchange Online mailboxes via Microsoft Graph
3. Exchange EWS — on-premises Exchange via Exchange Web Services
4. IMAP — any IMAP-compatible mail server (Zimbra, Dovecot, etc.)

Features

• Folder filtering — include or exclude specific folders (e.g. skip Junk, Drafts)
• Date range — migrate only messages within a specific date window to reduce volume
• Attachments — full attachment migration with size tracking
• Bulk Import (CSV) — upload a CSV with source/destination mailbox mappings to queue migrations for an entire organization in one step. See Bulk mail migration with user mapping for the CSV format, Gmail service-account + domain-wide delegation setup, and the M365 Mail.ReadWrite application permission requirement.

M365 Assessment Suite

What It Does

The M365 Assessment Suite is a family of six 100% read-only Microsoft Graph scans. Each produces a 1.0–4.0 composite score, a prioritized list of findings with stable IDs, and actionable recommendations. The suite covers everything from Copilot oversharing risks to Power Platform sprawl. Most scans finish in three to five minutes per tenant.

6 Assessment Products

1. Copilot Readiness — the flagship assessment. Evaluates whether your tenant is safe to enable Microsoft 365 Copilot and identifies exactly what to fix first.
2. Microsoft 365 Complete — a cross-cutting report that spans all modules. Bundle-only, not sold standalone.
3. SharePoint & OneDrive — focused deep-dive into SharePoint permissions, oversharing, OneDrive adoption, and cleanup opportunities.
4. Teams — Teams lifecycle governance, external sharing, guest access, and collaboration hygiene.
5. M365 Security — Identity, Conditional Access, MFA coverage, dangerous OAuth grants, and Global Admin sprawl.
6. Power Platform — environment sprawl, DLP policy gaps, unmanaged flows and apps, maker concentration risk.

7 Assessment Modules & 74 Finding IDs

Across all six products, findings are drawn from seven modules with a total of 74 unique finding IDs. Each product activates the relevant subset of modules. The Copilot Readiness product, for example, runs all seven; the Teams product runs only the Teams & OneDrive Governance module plus Identity & Conditional Access.

The 1.0–4.0 Score

The composite score is a weighted average across the active modules (SharePoint Permissions and Purview Current State are weighted 2× because they have the highest direct impact on Copilot oversharing). Every score lands in one of four bands:

• 1.0–1.9 — NOT_READY (red) — Critical gaps in DLP, oversharing, or identity will leak sensitive data through Copilot. Do not enable Copilot, even for a pilot, until the "Must Do Before Copilot" items are resolved.
• 2.0–2.9 — PARTIALLY_READY (orange) — Run a tightly scoped pilot with 5–10 hand-picked users on non-sensitive workloads only. Address all "Must Do Before Copilot" items before broadening.
• 3.0–3.4 — MOSTLY_READY (yellow) — Internal pilot approved for any team. Resolve the remaining "Must Do Before Full Rollout" items before expanding to your full user base.
• 3.5–4.0 — READY (green) — Full Copilot rollout approved. Maintain ongoing monitoring with quarterly reassessments to catch drift.

Setup & Required Scopes

All six M365 Assessment Suite products connect to your Microsoft 365 tenant via a service-account credential (Azure AD app registration with client_credentials flow). Setup is a one-time, ~5 minute task that covers every product.

The 14 Read-Only Graph Scopes

All scopes are application permissions requiring admin consent. None of them grant write access — the assessment is read-only by design.

• Sites.Read.All — SharePoint sites and permission settings
• Files.Read.All — OneDrive and SharePoint files (oversharing scan)
• User.Read.All — user profiles, license assignments, Copilot eligibility
• Group.Read.All — M365 groups and Teams membership
• Directory.Read.All — tenant directory and roles
• AuditLog.Read.All — audit log access verification
• InformationProtectionPolicy.Read.All — sensitivity labels and IP policies (tenant-wide)
• Policy.Read.All — Conditional Access and authentication policies
• Reports.Read.All — M365 usage and adoption reports
• SecurityEvents.Read.All — identity protection events
• TeamSettings.Read.All — Teams configuration and policies
• DelegatedPermissionGrant.Read.All — OAuth grants for risky-app detection
• Application.Read.All — app registrations for overprivileged-client detection
• SharePointTenantSettings.Read.All — tenant-wide SharePoint sharing settings

Step-by-Step Setup

Running an Assessment

From the Governance tab, click + Run New Assessment. Select the product type (Copilot Readiness, SharePoint & OneDrive, Teams, M365 Security, Power Platform, or Microsoft 365 Complete if you have the bundle). Choose the saved credential for the target tenant and click Run Assessment.

Live Progress

The wizard shows real-time progress for each module as it scans. Modules execute in parallel where possible. If a module encounters an unverified check (missing scope, beta endpoint 404), it marks those checks as unverified and continues — no module failure blocks the overall scan.

Re-runs

Paid tiers get unlimited re-runs within the 90-day access window. Free tier is limited to one assessment per tenant per month. Each re-run produces a fresh score and findings set, so you can track improvement over time from the score trend chart on the Governance landing page.

Reading the Report

Once the assessment completes, the wizard shows three things in order: the hero score banner, the module scorecard, and either the priority action cards (paid tiers) or the sneak-peek upgrade card (free tier).

Hero Score Banner

A large composite score (1.0–4.0) with the four-state pilot verdict colour-coded, the guidance paragraph for that verdict, the target tenant name, the assessment date, and the duration. Below the banner are the export buttons (paid tiers only) and a "Run Again" CTA.

Module Scorecard

One row per module with the per-module score (1–4), score label, finding count, and Graph call count. Modules with unverified checks (e.g. a missing scope or a 404 from a beta endpoint) show an "· some checks unverified" amber note. The scorecard is visible to all tiers including Free.

Finding Priorities

Each finding is tagged with one of three exact priority labels:

• Must Do Before Copilot — blockers. Do not enable Copilot until these are resolved. Most likely to surface in the Purview, Identity, and SharePoint Permissions modules.
• Must Do Before Full Rollout — pilot is safe but a wider rollout needs these closed first.
• Nice to Have — quality of life improvements that don't block Copilot but improve the long-term posture.

Each finding has a stable ID (e.g. PUR-001, SPO-004), a one-line observation, a business impact paragraph, an action-verb-first recommendation, the responsible role, an effort estimate, the exact Graph endpoint that produced the finding, and a Microsoft Docs link.

The Critical PUR-001 Check

The single most important check in the entire assessment is PUR-001 — DLP × Copilot workload coverage. It checks whether Microsoft365Copilot appears as a protected workload in any active Data Loss Prevention policy. Most tenants we see fail this check — their DLP rules block sensitive content in SharePoint, OneDrive, Teams, and Exchange but Copilot is not in the workload list, so Copilot can still surface that same content in chat responses, bypassing the entire DLP layer. PUR-001 is the killer finding before any Copilot rollout.

Privacy Mode

When you create an assessment you can toggle Privacy Mode on. In privacy mode the assessment runs normally and you see the score and module scorecard in the wizard, but the encrypted findings blob is not persisted to the database after the run completes. You'll see the report once and then it's gone. Useful for one-shot consulting engagements where the customer doesn't want their findings stored.

7 Assessment Modules

Every finding in the M365 Assessment Suite belongs to one of seven modules. Each module has a stable ID prefix and a defined scope of Graph API calls.

1. Licensing & Infrastructure (LIC-000 to LIC-010)

Checks subscribed SKUs, base tier detection (E3/E5/Business Premium), add-on presence (Copilot, Purview, Entra P1/P2, Audit Premium), M365 service health, and OneDrive adoption across the tenant. This module answers: do you have the licenses required for the features you want to use?

2. Purview State (PUR-000 to PUR-008)

Evaluates retention labels, Data Loss Prevention policies, sensitivity labels, and Sensitive Information Types. Includes the critical PUR-001 check that detects whether Microsoft365Copilot is a protected workload in any active DLP policy — the single most important check before any Copilot rollout. Also checks retention policy coverage and auto-labeling configuration.

3. Identity & Conditional Access (IDN-000 to IDN-013)

Inventories Conditional Access policies, MFA baseline coverage, guest user ratio, Global Admin count, PIM presence, OAuth grant sprawl, and dangerous application permissions. Flags overprivileged apps with Mail.ReadWrite or Files.ReadWrite.All that could leak data through Copilot responses.

4. M365 Apps Readiness (APP-000 to APP-006)

Analyzes Office update channel distribution across the tenant. Copilot requires Current Channel or Monthly Enterprise Channel — users stuck on Semi-Annual Channel cannot run Copilot. This module quantifies the upgrade effort.

5. Teams & OneDrive Governance (TMS-000 to TMS-006)

Evaluates Teams lifecycle hygiene (stale teams, orphaned teams, naming policies), tenant-wide external sharing capability, OneDrive adoption rates, and Known Folder Move (KFM) deployment status. KFM ensures desktop/documents/pictures are backed up to OneDrive, which Copilot indexes.

6. SharePoint Permissions (SPO-000 to SPO-013)

Performs a per-site permission audit across all SharePoint sites in the tenant (paid tiers scan all sites, free tier samples up to 30). Detects "Anyone with the link" oversharing, broken inheritance, mega-sites with 100k+ items, external sharing at the site level, and sites with no active owner. Each site gets a risk profile: Low / Medium / High / Critical.

7. Power Platform (PP-001 to PP-012)

Scans Power Platform environments, DLP policy coverage, unmanaged flows and canvas apps, maker concentration risk (single-person dependencies), and environment sprawl. Uses the BAP (Business Application Platform) API to enumerate environments and their policies.

SharePoint Restructuring Wizard

The Restructuring Wizard analyzes SharePoint site health and proposes a restructuring plan to break mega-sites into properly scoped site collections. It is available to tenants with a paid assessment purchase.

What It Analyzes

• Permissions complexity — broken inheritance depth, unique permission count at the library level (not file level)
• Storage distribution — storage consumed per library, identifying hot spots
• Stale content — libraries and folders with no modifications in 12+ months
• Large lists — lists exceeding the 5,000 item view threshold
• Folder depth — deeply nested folder hierarchies that cause sync and URL-length issues
• Item limits — sites approaching the 30 million item limit

Health Score

Each site receives a health score from 1 to 10. Sites scoring below 5 are flagged for restructuring with specific recommendations.

Execution

When you approve a restructuring plan, the wizard auto-provisions new site collections with the recommended structure and queues MigrationFox migration jobs to move content from the old mega-site into the new sites. Permissions are re-applied at the site collection level for clean inheritance.

OneDrive Cleanup Wizard

The OneDrive Cleanup Wizard scans up to 100 licensed users and identifies cleanup opportunities across five issue categories. It is available to tenants with a paid assessment purchase.

5 Issue Categories

1. Oversized — users consuming more than 80% of their OneDrive quota
2. Stale — OneDrives with no file modifications in 12+ months
3. External sharing — OneDrives with active external sharing links
4. Departed users — OneDrives belonging to disabled or deleted accounts
5. Orphan content — content in OneDrives with no active owner or manager

Export

Results can be exported as CSV for bulk remediation planning or integration with IT service management tools.

Continuous Monitoring

Tenants with monitoringEnabled turned on receive an automatic monthly re-scan. The system runs the same assessment that was last executed, compares the results to the previous scan, and sends an email comparison report.

Comparison Report

The monthly email includes:

• New findings — issues that appeared since the last scan (regressions)
• Resolved findings — issues that are no longer detected (improvements)
• Score delta — the change in composite score with a trend indicator

Exports (PDF / CSV / JSON)

Paid tiers can export assessment results in multiple formats. The available formats depend on the tier:

Export Formats

• PDF — full assessment report. Single assessment purchases include MigrationFox-branded PDF. Bundle purchases include white-label PDF with the buyer's logo (no MigrationFox branding) for client delivery.
• Word (.docx) — editable report for anyone who needs to add commentary or customize sections before delivering to a client or stakeholder.
• Excel (.xlsx) — findings in a structured spreadsheet with columns for ID, module, priority, observation, recommendation, effort, and responsible role.
• HTML — self-contained HTML report with inline CSS and no external resources. Can be hosted on an intranet or attached to an email.
• CSV (Planner format) — Microsoft Planner import format with Task / Bucket / Priority / Due / Assigned / Description / Labels columns. Import directly into Planner to create a remediation project.
• JSON — structured JSON export with all findings, action plan, module results, and metadata. Suitable for programmatic consumption or integration with SIEM/ITSM tools.

Pricing & Tiers

The M365 Assessment Suite is a separate product line from MigrationFox migration. It is six standalone read-only Graph audits sold under a single pricing model: one-time payment, 90-day access window, locked to one Microsoft 365 tenant at first scan. There is no subscription, no auto-renew, and no per-user fee. Two product shapes: a single assessment at CA$399, or the Microsoft 365 Complete Assessment Bundle at CA$1,599 which unlocks all six. Paid tiers also unlock the Restructuring Wizard, OneDrive Cleanup Wizard, and Continuous Monitoring.

Free Snapshot — CA$0

One assessment per tenant per month for any one of the six product lines. View-only — the composite score, the four-state verdict, the module scorecard with finding counts, and one sample finding rendered in the same format as the paid tiers. There are no exports of any kind and no email or webhook delivery on completion. The free tier exists to answer one question honestly: does your tenant have a problem in this area?

Single Assessment — CA$399 one-time

One-time payment, 90 days of unlimited re-runs, locked to one Microsoft 365 tenant at first scan. Choose one of: Copilot Readiness, Power Platform, SharePoint and OneDrive, Teams, or M365 Security. Full findings list across the relevant modules. JSON, HTML, and CSV exports. MigrationFox-branded PDF. Internal use license — the report cannot be re-delivered to a third party as a paid work product.

This is the right tier for an in-house IT or security team that owns one tenant, wants to drive a specific area to green, and needs to track score improvement over time. Re-runs are unlimited within the 90-day window.

Microsoft 365 Complete Assessment Bundle — CA$1,599 one-time

All six assessments in one purchase — Copilot Readiness, Power Platform, SharePoint and OneDrive, Teams, M365 Security, plus the cross-cutting Microsoft 365 Complete report (which is bundle-only and not sold standalone). 90 days of unlimited re-runs. Locked to one Microsoft 365 tenant at first scan. Includes white-label PDF with the buyer's logo (no MigrationFox branding) and a commercial redistribution license — the buyer may deliver the report to a paying client as their own engagement work product.

This is the right tier for MSPs and consultancies running readiness engagements across client tenants. One bundle = one client. The bundle saves CA$396 vs buying five singles, and the white-label rights make it the only legal way to resell the report to a client.

Per-tenant lock

Each purchase has a targetTenantId field that is null until the first scan, then immutably stamped with the Microsoft 365 tenant ID. Subsequent scans against a different tenant are blocked. This is the technical enforcement of the per-engagement pricing model. An MSP scanning ten client tenants needs ten purchases.

Full pricing comparison and FAQ on the dedicated Microsoft 365 Assessment Suite landing page.

API & Webhooks

The same authenticated REST endpoints used by the in-app wizard are available for programmatic access. All endpoints use the standard MigrationFox JWT auth header. Tier gates are enforced server-side — calling /export.json on a Free tier returns 402 with a copilot_insight_required body.

Endpoints

Webhook Event: governance.assessment.completed

If your tenant has a webhook URL configured (Billing → Webhook Notifications), MigrationFox fires a webhook event when each assessment finishes. The webhook is gated to Insight+ tiers — Free assessments do not fire webhooks. The same delivery mechanism handles both migration and governance events; consumers should switch on the X-MigrationFox-Event header.

Webhook Payload Example

{
  "event": "governance.assessment.completed",
  "assessmentId": "cmnxxx...",
  "tenantId": "ten_xxx...",
  "label": "Q1 Readiness Scan",
  "targetTenantId": "<M365 tenant GUID>",
  "targetTenantName": "Contoso Ltd.",
  "status": "COMPLETED",
  "overallScore": 2.8,
  "pilotState": "PARTIALLY_READY",
  "totalFindings": 14,
  "mustDoBeforeCopilot": 5,
  "durationMs": 198432,
  "timestamp": "2026-04-11T15:30:42.123Z"
}

HMAC-SHA256 signature is delivered in X-MigrationFox-Signature when a webhook secret is configured. The same headers are used as for migration job webhooks — X-MigrationFox-Event, X-MigrationFox-Delivery, and X-MigrationFox-Signature — so existing webhook handlers can simply add a switch on the event name.

Email Delivery

Insight+ subscribers also receive an email on each completed assessment with the score, the four-state verdict, the top 3 must-do actions, and a deep link back to the wizard. Email delivery uses Resend; if no RESEND_API_KEY is configured the email is silently skipped (best-effort delivery). Free tier assessments do not trigger emails.

Discovery / Scanning

Before migrating any data, MigrationFox scans your source environment to build a complete inventory. This process is called discovery.

Running a Discovery Scan

1. In your project, ensure the source connection is configured and authenticated
2. Click Start Discovery (or create a discovery job via the API)
3. MigrationFox will recursively scan all files, folders, and metadata
4. The scan typically takes a few minutes for small sources, up to several hours for millions of files

Discovery Report

After scanning completes, the discovery report shows:

• Total file count and total size
• Folder tree with nested file counts and sizes
• File type breakdown — e.g., 40% Documents, 30% Images, 20% Videos
• Large files over 100 MB (flagged for monitoring)
• Permission summary — who has access to what
• Duplicate detection — files with identical content hashes

Selective Migration

After discovery, you can choose to migrate everything or select specific folders. This is useful for phased migrations or excluding irrelevant content.

Provisioning

Provisioning creates the destination structure before migrating data. This ensures all target containers (sites, libraries, drives, folders) exist before files are transferred.

What Gets Provisioned

How to Use

1. Run Discovery on the source first
2. Review the folder structure in the discovery report
3. Configure any folder mappings if you want to remap paths
4. Click Provision Destination to create the structure
5. Once provisioning completes, start the migration

Migration Modes

MigrationFox supports three migration modes that determine how files are handled during transfer.

Folder Mapping

Folder mapping lets you remap source paths to different destination paths during migration. This is useful when the destination has a different organizational structure.

How It Works

You define mapping rules that transform source paths into destination paths:

Source Path                    →  Destination Path
/Marketing/2024/Campaigns     →  /Departments/Marketing/Campaigns-2024
/Engineering/Docs             →  /Technical/Documentation
/Shared/Photos                →  /Media Library/Photos

Mapping Rules

• Exact match — Map a specific folder to a specific destination
• Prefix match — Map all content under a source prefix to a destination prefix
• Flatten — Move all files from nested subfolders into a single destination folder
• Skip — Exclude specific folders from migration entirely

Conflict Resolution

When a file already exists at the destination with the same name, MigrationFox uses the conflict resolution strategy you've configured.

Permission Migration

MigrationFox can migrate file and folder permissions (sharing settings) from the source platform to the destination platform.

How Permissions Are Mapped

Permissions are mapped by email address. If a user has access to a file on the source (e.g., Google Drive sharing), MigrationFox will grant the same user access at the destination (e.g., SharePoint permissions), provided the user exists in the destination directory.

Permission Mapping Matrix

Bandwidth Throttling

Control the transfer speed to avoid saturating your network or hitting API rate limits.

Configuration

In your project settings, you can configure:

• Maximum bandwidth (MB/s) — Limits the total transfer speed
• Concurrency — Number of files transferred in parallel (default: 4)
• Schedule windows — Run migrations only during specific hours (e.g., nights/weekends)

Recommendations

Scheduling

Schedule migration jobs to run at specific times. This is useful for running migrations during off-peak hours or for recurring delta syncs.

How to Schedule

When creating or editing a migration job, set the Scheduled Start time. The job will be queued and will start automatically at the specified time.

Scheduling Options

• One-time schedule — Run once at a specific date and time
• Recurring schedule — Run on a schedule (e.g., daily at 2 AM for delta syncs)
• Immediate — Start the job right away (default)

{
  "jobType": "MIGRATION",
  "mode": "DELTA",
  "scheduledAt": "2026-03-25T02:00:00Z"
}

API Reference

MigrationFox provides a REST API for programmatic access to all migration features. Full API documentation is coming soon.

Authentication

All API requests require a Bearer token. Generate an API key from Settings → API Keys in the MigrationFox dashboard.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.migrationfox.com/v1/projects

Base URL

https://api.migrationfox.com/v1

Endpoints (Preview)

Webhooks

Configure webhooks to receive real-time notifications about migration events.

Supported Events

Configuration

In your project settings, go to Webhooks → Add Webhook. Provide:

• URL — Your endpoint that will receive POST requests
• Events — Which events to subscribe to
• Secret (optional) — Used to sign payloads for verification

Payload Example

{
  "event": "job.completed",
  "timestamp": "2026-03-24T15:30:00Z",
  "data": {
    "jobId": "job_abc123",
    "projectId": "proj_xyz789",
    "status": "COMPLETED",
    "filesTransferred": 15420,
    "bytesTransferred": 52428800000,
    "duration": 3600,
    "errors": 3
  }
}

Troubleshooting

Common errors and their solutions.

Still Need Help?

If your issue isn't listed above:

• Check the job details page for per-file error messages
• Review the audit log for detailed operation history
• Contact support at support@migrationfox.com

Security

MigrationFox is designed with security at every layer. Here's how your data and credentials are protected.

Data Handling Summary