Microsoft's own framing has three phases — Envision (pick and prioritise the scenarios, and set what success will be measured as), Onboard (ready the environment, land a plan), Drive Value (track adoption after go-live). Useful as far as it goes, and it deliberately does not tell you where things go wrong.

The one concrete industry benchmark worth quoting: for employee populations up to about 50,000, anticipate a six-to-nine-month migration window, change management included.

• 1. Assessment. Active Directory health, and an application inventory — specifically anything doing federated authentication or talking to Exchange directly. This is where you find the Exchange Web Services dependencies from chapter 3.
• 2. Identity foundation. Tenant, domain verification, sync method, authentication method. The hardest phase to unwind. Getting Cloud Sync versus Connect Sync, or hash sync versus federation, wrong here means a second migration project later.
• 3. Pilot. A small cohort on the full stack. Its job is to surface line-of-business application breakage, not to prove people like it.
• 4. Core workload migration. Exchange, SharePoint and OneDrive content, Teams-only mode.
• 5. Device onboarding. Autopilot waves plus Intune compliance and Conditional Access — usually partly parallel with phase 4, not strictly after it.
• 6. Voice cutover. Teams Phone. Start the number porting far earlier than this position in the list suggests — see below.
• 7. Security hardening. Purview labels, Data Loss Prevention rules, retention, Defender, tighter Conditional Access. Commonly sequenced after core migration to avoid compounding go-live risk — which does mean running unprotected for months, a trade worth making consciously rather than by default.
• 8. Decommission. Retire the legacy servers. Routinely slips, because once users are happy nobody owns it and nobody is measured on it.

The pattern across all four is worth extracting. Microsoft's tooling handles the Microsoft work reasonably well. What stalls a programme is everything at its edges — carriers, legacy applications, people, and money — which is exactly the part a technically-framed project plan under-weights.

One current operational note: since around March 2026, cross-tenant migrations hit Microsoft-side throttling by default. Administrators must request a temporarily raised throttling policy through the admin centre before migrating, or the project simply runs slowly for no visible reason.

Treat it as its own workstream with its own gate, not a feature toggle at the end. The oversharing remediation in chapter 8 is the long pole, it is information governance rather than AI work, and it must complete before broad enablement rather than alongside it. Typical pilots run 25–100 users. Run the pilot on paid licences — per chapter 7, the free tiers cannot see company content, so a free-tier pilot tests a different product.

• The tenant decision is close to permanent. No tenant merge exists in 2026, and SharePoint sites and Teams channels still cannot move between tenants.
• Conditional Access is the centre of gravity. It needs Entra ID P1, and that is most of what the gap between Office 365 E3 and Microsoft 365 E3 is buying.
• Licensing questions need a dated source. A confident, well-written, wholly stale answer is the standard failure — the Teams unbundling reversed in November 2025 and most published guidance never noticed.
• Copilot's blocker is permissions, not AI. Two-thirds of organisations have delayed over it, and the remediation is a governance programme most estates already needed.
• The time savings are real; the productivity claim is not established. Say both, in that order, and you will be more useful than either camp.

And the meta-point. Almost everything hard in this book was a rename, a reversal, or a default that changed — Azure AD to Entra, Endpoint Manager and back, four acts of Teams unbundling, three names for Microsoft Foundry in three years, a subprocessor auto-enabled in July. The durable skill here is not memorising the current state. It is the habit of checking the date on whatever you are reading, including this.