A 5-minute walkthrough of moving Kerio Connect mailbox data into a Microsoft 365 (Exchange Online) mailbox. Uses the 4n6 Kerio to Office 365 Migration Tool with modern authentication / OAuth, since Microsoft 365 disabled IMAP basic auth in 2022. If your destination is Google Workspace instead, see our Kerio to Gmail / Google Workspace guide. If you need a portable PST archive, see Kerio Connect to PST.
Video Transcript
Hello and welcome. This video shows how to migrate Kerio Connect mailbox data to a Microsoft 365 Office 365 account. We use the 4n6 Kerio to Office 365 Migration Tool. Important context: GFI does not provide an official tool for migrating data out of Kerio Connect, so a third-party tool is required. Microsoft 365 has stricter authentication than Gmail, IMAP basic auth was disabled in late 2022, so the migration tool must use OAuth or modern authentication when uploading directly to Exchange Online.
Step one. Set up Microsoft 365 first. Sign in to admin.microsoft.com, verify your custom domain, and assign a Microsoft 365 license to each destination user.
Step two. Stop Kerio Connect briefly, copy the user mailbox folders from the Store directory to a Windows workstation, restart Kerio.
Step three. Download and install the 4n6 Kerio to Office 365 Migration Tool.
Step four. Launch the tool. Click Choose Folders and browse to the copied Kerio Store. The tool walks each #msgs subfolder and shows the folder tree on the left. Tick the folders to migrate.
Step five. From the Export tab, pick Office 365. Enter the destination Microsoft 365 email address. Microsoft will prompt for OAuth sign-in in a browser window. Sign in with the destination account credentials and approve the Mail.ReadWrite permission.
Step six. Click Save to start the migration. The tool uploads each EML message to the Microsoft 365 mailbox via Exchange Online's modern auth-protected IMAP. A live progress bar shows uploaded count. When complete, a Notepad log lists items migrated, items skipped and any errors. Verify by opening Outlook on the web and checking the message counts match the source Kerio mailbox. Thanks for watching.
What This Migration Looks Like in 2026
Moving from Kerio Connect to Microsoft 365 is one of the most common SMB email migrations in India and globally, but the authentication landscape changed substantially in late 2022 and is changing again at the end of 2026. Picking the right approach in 2026 depends on understanding what's currently allowed.
This guide assumes the target is a Microsoft 365 Business plan (Business Basic, Business Standard, Business Premium) or Microsoft 365 Enterprise, both of which include Exchange Online mailboxes. The same procedure works for standalone Exchange Online Plan 1 or Plan 2 subscriptions. The source Kerio Connect can be any version 7.x through 10.x, running on Windows, Linux or Mac OS.
The tool used in this video is the 4n6 Kerio to Office 365 Migration Tool (version 3.0, 42.8 MB installer). It is a different product from the 4n6 Kerio Server Converter (PST output) and the 4n6 Kerio to Gmail Converter (Workspace destination). Pick the one that matches your destination.
Three Paths from Kerio to Microsoft 365
For a Kerio-to-M365 project there are three realistic paths. Pick based on mailbox size, number of users and how much you trust your internet stability.
| Path | When to pick it |
|---|---|
| Direct cloud upload (this video) | Pick for small to mid-size migrations (under 100 GB total, under 50 users). Uses 4n6 Kerio to Office 365 Migration Tool. Reads Kerio Store directly, uploads to M365 mailboxes via OAuth-authenticated IMAP. Pros: simplest workflow, no PST intermediate, messages appear live as upload progresses. Cons: depends on stable internet through entire upload, needs OAuth sign-in per destination user. |
| PST intermediate + Microsoft Network Upload | Pick for very large migrations (100 GB+ or 50+ users). First convert Kerio Store to PST using the 4n6 Kerio Server Converter (see our Kerio to PST guide), then upload the PSTs to Microsoft 365 via the free Network Upload service in the Microsoft Purview compliance portal. Pros: bypasses IMAP rate limits, runs faster on enterprise-scale data, free Microsoft tool for the upload phase. Cons: more administrative steps, requires AzCopy + Azure storage URL. |
| Exchange Online IMAP migration (admin-driven) | Pick when Kerio is still running and you want Microsoft to pull the data instead of pushing it. Configure Kerio as IMAP source in Exchange admin center > Migration. Microsoft pulls from Kerio's IMAP, writes to M365 mailboxes server-to-server. Pros: free, official Microsoft path, no third-party tool. Cons: requires live Kerio with IMAP enabled, doesn't migrate calendar or contacts, slower for large mailboxes, many tenants find the EAC migration UI fragile. |
Microsoft 365 Tenant Pre-Migration Checklist
This is where most M365 migrations stumble. The Kerio side rarely has problems. The destination side has prerequisites that need to be in place before the first byte uploads.
| Check | Why it matters |
|---|---|
| Microsoft 365 subscription active | Pick a plan that includes Exchange Online mailboxes (Business Basic, Business Standard, Business Premium, Enterprise E1/E3/E5, or standalone Exchange Online Plan 1 or 2). Plans without Exchange Online (Apps for Business) cannot accept mail. |
| Custom domain verified | Add yourcompany.com to admin.microsoft.com > Settings > Domains. Verify ownership via DNS TXT record. Domain must be verified before destination users can be created on that domain. |
| Destination users created | Create each Kerio user as a Microsoft 365 user at admin.microsoft.com > Users > Active users. Use the same email address as Kerio (raj@yourcompany.com on Kerio = raj@yourcompany.com on M365). |
| Mailbox license assigned per user | Each user needs a license that includes Exchange Online. Without a license, no mailbox is created and migration silently fails. Assign at admin.microsoft.com > Users > user > Licenses and apps. |
| Mailbox actually provisioned | License assignment triggers mailbox creation but takes 5-30 minutes. Verify each destination user has a working mailbox by signing them in to outlook.office.com first. If "Welcome to Outlook" page shows, mailbox exists. |
| OAuth modern auth enabled (default) | Modern authentication is on by default for new tenants. Verify at admin.exchange.microsoft.com > Settings > Modern authentication. If you have an old tenant where it was once disabled, re-enable it. |
| Conditional Access policy review | Some enterprise tenants block third-party apps via Conditional Access policies in Microsoft Entra (formerly Azure AD). If the migration tool's OAuth sign-in fails with "your sign-in was blocked", an admin needs to allow the tool's app ID or temporarily exempt the migrating user. Most SMBs do not have these policies. |
| MFA configured for destination users | If the destination M365 user has MFA enabled (recommended), the OAuth sign-in prompt during migration will ask for the MFA challenge. Have the user available with their phone or authenticator app at the moment migration starts. |
| Kerio Store folder copied off the live server | Stop Kerio Connect briefly, copy the Store/Mail/<domain>/ folder to a Windows workstation, restart Kerio. |
| Stable internet connection | The migration is a sustained upload over the network. 50 GB on 50 Mbps Indian broadband takes roughly 2.5 hours. Use wired ethernet, not Wi-Fi, for stability through the full upload window. |
| MX records still pointing at Kerio | Do NOT change MX records before migration completes. Mail flow stays on Kerio so no incoming messages are lost. Cutover happens after verification. |
| Trial run with one user first | Migrate one volunteer user end-to-end before kicking off a bulk migration. This catches issues with licenses, OAuth permissions, MFA prompts, and folder name handling before they hit your bulk job. |
Tool Specifications
| Specification | Value |
|---|---|
| Tool name | 4n6 Kerio to Office 365 Migration Tool |
| Vendor | 4n6 Software (forensiksoft.com) |
| Version | 3.0 (size 42.8 MB installer) |
| Rating | 4.7 / 5 from 845 reviews |
| Trial limit | 10 items per folder, free download |
| Operating system | Windows 7 / 8 / 10 / 11 (32 or 64-bit), Windows Server 2008 / 2012 R2 / 2016 / 2019. Migration tool is Windows-only even though source Kerio Connect runs cross-platform. |
| Source Kerio Connect versions | Kerio Connect 7.x, 8.x, 9.x, 10.x. All GFI Kerio Connect releases. |
| Source Store access | Read access to Kerio Store/Mail/<domain>/<user>/ tree. Local copy, network share, USB drive all work. |
| Destination | Microsoft 365 (any plan with Exchange Online), standalone Exchange Online, or hosted Exchange. |
| Destination authentication | OAuth 2.0 / Modern Authentication. Tool opens a browser sign-in window and uses XOAUTH2 to authenticate the IMAP upload. App passwords are NOT used for M365 work/school accounts. |
| RAM | 2 GB minimum, 4 GB recommended for large mailboxes |
| Disk space | 125 MB for installation. No PST output, so no extra archive disk needed. |
| Internet | Required throughout the upload. Wired ethernet recommended. |
| Migration types supported | Emails, calendar events, contacts, tasks, notes, attachments. Multi-user batch mode. Selective folder migration with date filters. |
6 Steps to Migrate Kerio Connect to Microsoft 365
-
Set up Microsoft 365 destination first. Sign in to admin.microsoft.com. Verify your custom domain at Settings > Domains via DNS TXT record. Create destination users at Users > Active users with the same email addresses as their Kerio accounts. Assign a Microsoft 365 license that includes Exchange Online to each user. Wait 5-30 minutes for mailboxes to provision. Verify by signing in as a destination user at outlook.office.com.
-
Copy the Kerio Store folder to a Windows workstation. On the Kerio server, stop the Kerio Connect service for the copy (services.msc on Windows, sudo systemctl stop kerio-connect on Linux). Copy the user mailbox folders from Store\Mail\<domain>\ to your Windows workstation. Restart Kerio Connect after the copy completes so users keep getting mail during the upload phase.
-
Install the 4n6 Kerio to Office 365 Migration Tool. Download the installer (42.8 MB) from forensiksoft.com. Install on the Windows workstation. The tool is standalone and does not require Kerio Connect, Outlook, or any Microsoft client to be installed.
-
Load Kerio mailbox and select folders. Open the converter. Click Choose Files, Choose Folders, or Auto Configure if Kerio is installed locally. Browse to the copied Kerio Store user mailbox at Store\Mail\<domain>\<user>\. The tool walks each #msgs subfolder, parses every .eml file, and displays the folder tree on the left panel: Inbox, Sent Items, Drafts, custom folders, MyContacts, MyCalendar, MyTasks, MyNotes. Tick the folders to migrate.
-
Pick Office 365 and authenticate via OAuth. From the Export tab, pick Office 365. Enter the destination Microsoft 365 email address. Click Save. Microsoft opens an OAuth sign-in prompt in your browser. Sign in with the destination account credentials. If MFA is enabled, complete the MFA challenge with your authenticator app. When prompted, approve the Mail.ReadWrite permission for the migration tool. The browser closes and the tool proceeds.
-
Click Save and verify in Outlook on the web. Migration starts. The tool uploads each EML message to the Microsoft 365 mailbox via Exchange Online's modern auth-protected IMAP endpoint. A live progress bar shows uploaded count. When complete, a Notepad log lists items migrated, items skipped, and any errors. Sign in to outlook.office.com as the destination user and verify the folder structure and message counts match the source Kerio mailbox.
Common Errors and Fixes
| Error or symptom | Cause and fix |
|---|---|
| OAuth sign-in fails with "your sign-in was blocked" | Conditional Access policy in Microsoft Entra is blocking the migration tool's app. An admin needs to allow the tool's app ID, exempt the migrating user, or temporarily disable the policy. SMBs without enterprise security policies usually don't hit this. Common in tenants with strict Microsoft Entra security configurations. |
| "Mailbox not found" or "User does not have a mailbox" | Microsoft 365 license is not assigned, or licence was assigned recently and mailbox is still being provisioned. Check at admin.microsoft.com > Users > user. License must include Exchange Online. After assignment, wait 30 minutes and verify by signing in to outlook.office.com as that user. |
| "Authentication failed" using app password | App passwords don't work for Microsoft 365 work or school accounts. Microsoft removed IMAP basic auth (and therefore app password support for IMAP) in late 2022. Use OAuth via the tool's browser sign-in prompt instead. App passwords still work for personal @outlook.com / @hotmail.com accounts but those are rarely the destination for SMB migrations. |
| MFA prompt times out during migration | The OAuth sign-in flow expects the user to complete MFA within ~60 seconds. If the user is not at their phone, it times out. Coordinate with each destination user to be available at their authenticator app at the start of their migration. For bulk migrations, schedule per-user authentication windows. |
| Upload starts then stalls after a few hundred messages | Hit Exchange Online's IMAP throttle. M365 imposes per-mailbox connection and message rate limits to prevent abuse. The tool throttles automatically and resumes after a pause. For large mailboxes plan to run overnight. If progress stops entirely for over 30 minutes, restart the tool. |
| Calendar items appear as plain emails in Outlook Inbox | The tool wrote MyCalendar EML files as regular mail messages instead of converting to Outlook calendar items. Re-run the conversion separately for MyCalendar with output set to ICS, then import the ICS file into the destination user's Outlook calendar via outlook.office.com > Calendar > Import calendar. |
| "Message size exceeds the maximum limit" | Exchange Online has a 150 MB per-message size limit (configurable per-mailbox up to 150 MB on most plans). EML files in the Kerio Store with attachments larger than this limit will skip silently. Check the conversion log for "size exceeded" entries. For these messages, extract the attachments separately and upload via OneDrive with a link in the email body. |
| Migration completes but message counts do not match | Some messages skipped due to malformed headers, attachment encoding errors, or duplicate detection by Exchange Online. Review the log carefully. Common causes: messages with non-UTF-8 subject lines, attachments encoded with obsolete MIME variants, messages with future-dated headers. Most can be skipped without business impact, but document any genuine gaps. |
| "Mailbox storage quota exceeded" | Default Exchange Online mailbox quota is 50 GB on most M365 plans, 100 GB on E3+ plans. If a Kerio user mailbox is 80 GB, the migration cannot complete on Business Standard. Check current quota at admin.exchange.microsoft.com > Recipients > Mailboxes > user. Upgrade to E3+ if needed, or split the user's data across primary mailbox + In-Place Archive (which adds 50 GB). |
| Connection drops mid-migration | Indian residential broadband often has 5-30 second drops on Wi-Fi. Use wired ethernet. If drops continue, split the migration into per-folder batches. Smaller batches mean smaller restarts when the connection breaks. |
PST Intermediate Path (When This Is Better)
For migrations over 100 GB total or 50+ users, the PST-intermediate path via Microsoft's free Network Upload service is often faster and more reliable than direct cloud upload. The trade-off is more administrative complexity.
| Phase | What happens |
|---|---|
| 1. Convert Kerio to PST locally | Use the 4n6 Kerio Server Converter to convert Kerio Store data to PST files, one per user. See our Kerio to PST guide for the conversion procedure. Output: a directory of PST files like raj@yourcompany.com.pst, priya@yourcompany.com.pst. |
| 2. Get Azure storage SAS URL | In Microsoft Purview compliance portal > Data lifecycle management > Microsoft 365 > Import, click New import job. Pick Upload your data. The wizard provides a one-time SAS (Shared Access Signature) URL to a Microsoft-managed Azure Storage container. |
| 3. Upload PSTs with AzCopy | Download AzCopy v10 from Microsoft. Run azcopy.exe copy with the PST folder as source and the SAS URL as destination. AzCopy uploads PSTs in parallel, resumes on failure, and is much faster than IMAP upload because it bypasses message-level rate limiting. |
| 4. Create CSV mapping file | Build a CSV with columns Workload, FilePath, Name, Mailbox, etc. Each row maps a PST file to a destination M365 user mailbox. Microsoft provides a CSV template in the Network Upload documentation. |
| 5. Submit import job | Back in Purview, submit the CSV. Microsoft analyses the uploaded PSTs and shows a preview. Approve the job. Microsoft writes the PST contents into the destination mailboxes server-side (no IMAP, no rate limiting). Typical throughput: 24-72 hours for ~500 GB. |
| 6. Verify and clean up | After completion, verify message counts in destination mailboxes via Outlook on the web. Microsoft auto-deletes the temporary Azure container 30 days after job completion. Do not leave PST files locally beyond your retention requirement. |
When to pick PST intermediate over direct upload: total Kerio Store over 100 GB, more than 50 users, internet connection unreliable, you also need a PST archive copy for compliance / legal hold, you have a global admin willing to drive the Microsoft Purview workflow.
MX Record Cutover to Microsoft 365
The mail-flow cutover from Kerio to Microsoft 365 looks similar to the Workspace cutover but uses different MX endpoints. Get this right and incoming mail seamlessly switches over. Get it wrong and mail bounces or lands at the old server for hours.
| Phase | What happens |
|---|---|
| Before migration | MX records point to Kerio. All mail flows to Kerio. No mail flow change yet. Migration tool uploads historical mail to M365 mailboxes in parallel. |
| Migration in progress | Run the 4n6 Kerio to Office 365 Migration Tool for all users. Mail still flowing to Kerio. Plan for a Friday-night start so it finishes by Sunday. |
| Verification phase | Sign in to each destination M365 mailbox at outlook.office.com. Verify message count, folder structure, and a few key recent emails. Have each user verify their own mailbox if possible. |
| MX cutover | Update DNS MX records at your registrar. Set the primary MX to <yourdomain>-com.mail.protection.outlook.com with priority 0. The actual hostname is shown in admin.microsoft.com > Settings > Domains > your domain > DNS records. Set TTL to 300 seconds a day before for fast propagation. Per Microsoft's domain setup guide. |
| Cutover window | For 24-48 hours, mail can land at either Kerio or M365 as DNS propagates. Configure Kerio to forward all incoming mail to the M365 domain so nothing is lost during the propagation gap. After full propagation, mail flows only to M365. |
| Post-cutover | Keep Kerio running read-only for 30-90 days as a safety net. Decommission Kerio Connect once you're confident no missed mail remains. |
Tool Comparison: Kerio to Office 365 Migration Options
| Tool | Notes |
|---|---|
| 4n6 Kerio to Office 365 Migration Tool (this video) | Direct OAuth-authenticated cloud upload to Exchange Online. Trial: 10 items per folder. Windows only. Sister products: 4n6 Kerio Server Converter (PST output) and 4n6 Kerio to Gmail Converter (Workspace destination). |
| Microsoft Network Upload (free) | Requires PST intermediate. Free, official Microsoft tool. Best for 100 GB+ migrations. Documented at Microsoft Learn: Use Network Upload to Import PST Files. Combines cleanly with the 4n6 Kerio Server Converter for the PST conversion phase. |
| Exchange Online IMAP migration (admin-driven) | Free, official, no third-party tool. Configure Kerio as IMAP source in Exchange admin center > Migration. Microsoft pulls. Pros: free. Cons: requires live Kerio with IMAP enabled, doesn't handle calendar or contacts, EAC migration UI fragile, slow on large mailboxes. |
| RecoveryTools Kerio Migrator | Similar pricing range to 4n6. Strong cloud destination support including Microsoft 365, Workspace, Yahoo, Outlook.com. Trial: 25 items per folder. Windows only. |
| BitRecover Kerio Converter | Starter $89. 25+ saving formats including direct M365 upload. 30-day money-back guarantee. Trial: 25 items per folder. |
| Transend Migrator (Kerio to M365) | Enterprise tool. Documented in their Kerio to Office 365 reference guide. Higher price. Used by IT consultancies for enterprise migrations with parallel processing. |
| SysTools (no dedicated Kerio-to-O365 product) | SysTools does not ship a dedicated Kerio Connect to Office 365 migration tool. Their closest match is the SysTools IMAP Migration tool for live-server IMAP migration. Picked when source Kerio is still running and IMAP-accessible; not suitable when only Store folder backups remain. |
Real Migration Scenarios
| Scenario | Approach and notes |
|---|---|
| SMB retiring on-premises Kerio Connect, 20-50 users to M365 Business Standard | The most common case in India. Total Store 30-200 GB. Direct cloud upload with the 4n6 tool. Plan one weekend of upload. Each user authenticates via OAuth at the start of their migration. Schedule per-user authentication slots so you're not waiting on availability. |
| Large enterprise migration, 200+ users, 1+ TB total | PST intermediate via Microsoft Network Upload. Convert Kerio to PST overnight using the 4n6 Kerio Server Converter, then upload PSTs via AzCopy to Azure storage, then submit a Network Upload job. Microsoft's server-side import is much faster than IMAP at this scale. Allow 1-2 weeks total. |
| Domain rebrand: Kerio on oldcompany.com, M365 on newcompany.com | Map source mailbox to destination email via the tool's per-user OAuth. For each user, sign in as new@newcompany.com when prompted. The tool uploads source folders into the new mailbox. Consider also setting up a forwarding rule on the M365 side so old@oldcompany.com still routes to new@newcompany.com during the transition. |
| Kerio on Linux server, M365 destination | Common in mixed-OS Indian SMBs. Copy the Kerio Store from /opt/kerio/mailserver/store/mail/ to a Windows workstation via scp, rsync or USB drive. EML format is portable. Migration tool runs on Windows side. |
| Phased hybrid migration: 10 pilot users first, rest later | Migrate IT and management first as a pilot. Verify M365 setup works end-to-end with 10 mailboxes before bulk. During the hybrid period, set Kerio to forward mail for migrated users to their M365 addresses. Roll out remaining users in batches over 2-4 weeks. MX cutover happens after everyone migrates. |
| Departed-employee archive into a shared M365 mailbox | When an employee leaves, migrate their Kerio mailbox into a shared mailbox in M365 (free, no license needed for under 50 GB). HR or the manager retains access. Allows compliance access without paying for a per-user license long-term. |
đź’ˇ Pro tips for Kerio to Office 365 migrations
- Run migration before MX cutover, never after. Mail flow stays on Kerio during migration so historical mail uploads while no new mail is being lost. Cut over MX only after verification.
- Coordinate per-user OAuth authentication slots. Each destination user has to be at their phone to complete MFA at the moment their migration starts. For bulk migrations, schedule a 5-10 minute window per user. Or migrate one user at a time over a longer period.
- Wired ethernet on the migration workstation. Sustained IMAP uploads to Exchange Online are sensitive to connection drops. Indian Wi-Fi on residential broadband often has 5-30 second outages that break the session. Wired connection is significantly more reliable.
- Pre-create destination mailboxes 30 minutes before migration. License assignment triggers mailbox provisioning but it takes time. Assign licenses early, verify each user can sign in to outlook.office.com, then start migration.
- Use the PST intermediate path for migrations over 100 GB. Microsoft Network Upload is free and bypasses IMAP rate limits. The combination of 4n6 Kerio Server Converter + AzCopy + Network Upload is faster than direct IMAP for enterprise-scale data.
- Verify quota before migration. Default mailbox quota is 50 GB on M365 Business plans, 100 GB on E3+. If a Kerio mailbox exceeds the destination quota, upgrade the user's plan or split data across mailbox + In-Place Archive (additional 50 GB on E3+).
- Check Conditional Access policies. If your tenant uses Microsoft Entra Conditional Access (common in enterprises, rare in SMBs), the migration tool's OAuth sign-in may be blocked. Test with one user first. If blocked, an admin needs to allow the tool's app or temporarily exempt the migrating user.
- Plan MX cutover for off-hours. Most Indian SMBs prefer Friday-night start so the upload runs over the weekend and Monday morning users are on M365. Avoid Monday or Tuesday cutovers, you have less time to fix issues before the working week ramps up.
- Keep the Kerio Store folder for 90+ days. If a user reports missing email after migration, you can re-extract from the original.
- If your destination is Google Workspace instead, use the 4n6 Kerio to Gmail Converter guide. Different destination, different OAuth flow, different rate limits.
- If you also need a PST archive copy alongside the cloud migration, see our Kerio Connect to PST guide. Run that conversion in parallel to keep a portable backup.
Frequently Asked Questions
Can I use IMAP with username and password to migrate to Microsoft 365?
No. Microsoft permanently disabled IMAP basic authentication in Exchange Online for all tenants in late 2022 as part of the multi-year basic auth deprecation. Any migration tool that needs to write to a Microsoft 365 mailbox via IMAP must use OAuth (modern authentication). The 4n6 Kerio to Office 365 Migration Tool handles this with an OAuth sign-in prompt that opens in your browser when you start the migration.
Do app passwords work for Microsoft 365 work or school accounts?
App passwords work for Microsoft personal accounts (@outlook.com, @hotmail.com, @live.com) but not for Microsoft 365 work or school accounts on a custom domain. M365 work/school accounts only accept OAuth/modern authentication for IMAP, EWS and other Exchange protocols. If you need to migrate to a custom-domain M365 mailbox, the migration tool must use OAuth, not an app password.
What is the difference between the migration tool path and Microsoft Network Upload?
The 4n6 migration tool uploads EML messages directly from the Kerio Store to Microsoft 365 mailboxes via OAuth-authenticated IMAP. Microsoft's Network Upload service is a different path: you first convert Kerio data to PST files (using the 4n6 Kerio Server Converter or similar), then upload PSTs to a temporary Azure storage location, then run a PST import job from the Microsoft 365 admin center. Network Upload is free and best for very large migrations (100 GB+) because it bypasses IMAP rate limits, but it requires a PST intermediate and more administrative steps.
Do I need an admin account for the migration?
For per-user OAuth migrations (this video), you sign in as the destination user themselves. The user must have a Microsoft 365 license assigned and a valid mailbox. For multi-user migrations, you can either run the tool once per user with each user signing in, or use a global admin account that has been granted application impersonation rights to write to multiple mailboxes. The cleanest approach for SMBs is to migrate one user at a time with the user themselves authenticating.
How does migration handle calendar and contacts?
Kerio stores calendar items as EML files in the MyCalendar folder with iCalendar payloads, and contacts as EML files in MyContacts with vCard payloads. The 4n6 tool detects these special folders and writes them into the corresponding Outlook calendar and contacts folders in the destination M365 mailbox. Verify by opening Outlook on the web after migration: events should appear in the Calendar tab, not the Inbox. If they appear as plain emails, run the conversion separately for those folders with output set to ICS or vCard, then import via Outlook on the web.
Should I migrate or change MX records first?
Migrate first, change MX records last. Run the migration tool while Kerio Connect is still receiving mail so no incoming messages are lost. Verify all historical mail has uploaded to Microsoft 365 mailboxes. Only after verification, schedule a maintenance window to update DNS MX records pointing to Microsoft's MX endpoint at <yourdomain>.mail.protection.outlook.com (the actual hostname is shown in the M365 admin center after domain verification). DNS propagation typically takes 1-4 hours.