Switching to Google Workspace? Don’t Miss a Single Email with Our Pro Checklist

Switching from Microsoft 365 to Google Workspace is a strategic move for small businesses looking for cost savings, increased collaboration, and greater operational agility. For Canadian SMBs, this transition often results in lower licensing costs, simplified IT administration, and more modern workflows built around Gmail and Google’s productivity suite. However, the migration process can be daunting without a comprehensive plan. Here, we present an actionable checklist—rooted in our extensive migration expertise at Interlock IT—to guide your business through each stage confidently and effectively.

What Is a Microsoft 365 to Google Workspace Migration?

A Microsoft 365 to Google Workspace migration involves transferring your company’s email, calendars, contacts, files (such as those in OneDrive and SharePoint), and user identities from Microsoft’s cloud productivity suite to Google Workspace. The goal is to preserve all business-critical data and maintain productivity while unlocking Google’s collaborative tools.
This process requires careful preparation, technical expertise, and a stepwise approach to minimize data loss, avoid downtime, and ensure compliance.

Why Small Businesses Choose to Switch

Many businesses are moving to Google Workspace to benefit from:

• Lower costs: Flexible monthly or annual billing (with savings for annual commitment) and no long-term lock-ins.

• Enhanced collaboration: Real-time editing in Google Docs, Sheets, and Slides, avoiding the version conflicts common in Microsoft Office files.

• Gmail-centric workflows: Seamless integration with familiar Gmail interfaces, third-party apps, and cloud-based collaboration.

• Unified management: Centralized tools to manage users, devices, and security with Google Admin Console.

• Streamlined integrations: Google Workspace connects natively with business SaaS tools like Copper CRM and Hiver, both of which are supported by Interlock IT.

With offices in Mississauga and Detroit, Interlock IT has helped thousands of businesses move to Google Workspace since 2009, continually refining what works best for Canadian SMBs.

Microsoft 365 to Google Workspace Migration Checklist

Below is our proven, step-by-step migration framework. Every step is designed to ensure a safe transition, as practiced by Interlock IT's Google Workspace Certified Deployment Specialists.

1. Pre-Migration Planning

• Inventory Users and Data: Export user lists (emails, aliases), distribution groups, calendars, OneDrive files, and SharePoint sites from the Microsoft 365 Admin Center.

• Backup Your Data: Secure all data with a robust backup solution. Interlock IT recommends Afi.ai's enterprise-grade backups for both Microsoft 365 and Google Workspace, ensuring infinite retention and ransomware protection.

• Review Licensing and Contracts: Check your Microsoft 365 renewal to avoid overlapping license fees. Decide when to cut over so you aren’t billed for both platforms.

• Set Up Google Workspace: Sign up for Google Workspace Business Standard or Business Plus. Verify your domain via TXT record—do not change MX records yet.

2. Account and Identity Creation

• Create Google Workspace User Accounts: In the Google Admin Console, add users that precisely match your existing email addresses and aliases. This step is critical to preserve data continuity. Interlock IT can automate bulk account creation for your team.

• Assign User Roles: Define admin privileges and user groups as needed for access control.

3. Data Migration Execution

• Contacts and Calendars: Use Google’s native Data Migration Service to transfer contacts and calendars first as a test run.

• Email Migration: Use Google’s Data Migration Service to transfer email from Microsoft 365 mailboxes. Schedule the migration over a weekend for minimal disruption. For organizations up to 250 users, this native tool is usually sufficient. For more complex needs, specialized 3rd party tools plus Interlock IT expert services can be used. 

• File Migration (OneDrive/SharePoint to Google Drive): Set up Google Shared Drives to mirror your SharePoint structure. Use our Interlock IT professional services  partner for advanced requirements such as preserving permissions.

• DNS Preparation and Deliverability Setup: Prepare SPF, DKIM, and DMARC records for your domain but do not update MX records until data migration is complete. As email deliverability experts, Interlock IT recommends a DMARC audit prior to cutover. For in-depth DMARC guidance, see our blog on implementing a DMARC audit checklist for small businesses.

4. Cutover and Validation

• Switch MX Records: Point your domain’s MX records to Google’s servers to route all new emails to Google Workspace.

• Perform Delta/Final Sync: Run another migration sync to catch messages delivered to Microsoft 365 during the cutover window.

• Verify Data Integrity: Check inboxes, sent items, drafts, attachments, calendar entries, and Google Drive folders to ensure everything migrated as expected.

• Roll Out Google Workspace to End Users: Share quick-start guides and schedule Q&A sessions. Consider piloting the migration with a small team first before company-wide rollout, especially for teams larger than 20 users.

Best Practices for a Smooth Migration

• Plan for a Weekend Window: Scheduling your cutover over a weekend or during low-activity periods reduces the business impact.

• Data Integrity Verification: Check permissions, folder structures, and critical calendars/files for accuracy post-migration.

• Communicate Often: Keep your team informed through each step, set clear expectations, and provide a channel for questions.

• Leverage Backups: Maintain pre- and post-migration backups, using services like Afi.ai through Interlock IT.

• DMARC Auditing: Implement DMARC early in collaboration with your migration partner. 

• Integrate Core Apps: Once settled, connect Google Workspace to business-critical services like Copper CRM and Xero Accounting for streamlined workflows.

Common Pitfalls and How to Avoid Them

• Overlooking SPF, DKIM, and DMARC: Failure to configure these properly can cause outbound email to be marked as spam. Partner with Interlock IT for comprehensive deliverability audits.

• Insufficient User Training: Early adoption is driven by confidence. Schedule onboarding and provide user guides to reduce resistance.

• Manual File Transfers: Drag-and-dropping hundreds of files can lead to omissions and permission losses. Use professional tools or expert-led services for structured data migration.

• Ignoring Licensing Overlaps: Overlapping subscriptions lead to doubled costs. Time your cutover just before Microsoft 365 renewal dates.

Integrating Google Workspace with Business Apps

Google Workspace connects natively with leading business solutions, including:

• Copper CRM: For sales tracking and customer management, tightly integrated with Gmail and Google Drive.

• Xero Accounting: Real-time financial insights, CPA-backed support, and Google SSO for streamlined authentication.

• Hiver Help Desk: Shared email and ticketing within the familiar Gmail UI.

Interlock IT specializes in fast deployment of these integrations so businesses realize value in days, not months.

How Interlock IT Supports Your Migration

• Proven Track Record: Since 2009, we have led countless successful migrations for Canadian SMBs, with consistent results highlighted in our client testimonials.

• End-to-End Service: Includes requirements assessment, user communication plans, technical cutover, and change management strategies.

• Data Security: Our team uses trusted backup and migration tools to ensure nothing is lost and everything is compliant.

Learn more about our migration expertise on our Google Workspace services page.

FAQ: Microsoft 365 to Google Workspace Migration for Small Businesses

How long does a migration typically take?

The total migration project timeline is dependent on the number of integrated apps that need to be tested in advance of the cutover. The actual migration process is always completed over a weekend even for thousands of users.

Will I lose any email or file data?

If the migration checklist is carefully followed—including robust pre-migration backups—no data should be lost. Interlock IT ensures data integrity with advanced backup and migration tools, and post-migration validation.

What are common challenges during migration?

The most common issues are missed calendar events, data formatting mismatches, email deliverability errors (due to incomplete DNS records), and loss of file sharing permissions. Expert planning and validation, as delivered by Interlock IT, prevent these pitfalls.

How do I make sure outgoing emails aren’t marked as spam?

Implement SPF, DKIM, and DMARC as part of your migration. Interlock IT provides DMARC audits to align your email authentication for strong deliverability.

What if I need to migrate multiple domains or complex file structures?

Complex migrations call for advanced tools and expert oversight. Interlock IT manages these scenarios routinely, providing full project management and post-migration checks.

Conclusion

Switching from Microsoft 365 to Google Workspace is a significant upgrade for small businesses that prioritize modern collaboration, cost efficiency, and simplicity. By following a clear, expert-led migration framework, you preserve critical business data and ensure your team is empowered from day one.

For the most seamless experience, partner with Interlock IT: Canada’s trusted leader in cloud business transformations since 2009. We’re here to help with every aspect of your move—from planning to post-migration support. Get started or request a free DMARC audit by contacting us at support@interlockit.com.

Microsoft 365 Backup Policies for SMBs: Retention, Legal Hold, and Ransomware Recovery Explained

 Many small and medium-sized businesses (SMBs) trust Microsoft 365 to keep their communications, files, and business records safe. However, there's widespread confusion about what Microsoft 365 retention policies, legal hold features, and ransomware recovery actually provide — and what they don’t. As industry-leading cloud consultants at Interlock IT, our role is to make these distinctions clear, so you can plan real-world protection for your data, maintain compliance, and remain resilient in the face of threats.

Understanding Microsoft 365 Backup, Retention, and Legal Hold

Microsoft 365 offers several built-in data protection tools, but these are not true backups. Retention policies and legal holds are primarily for compliance, not for comprehensive restoration after loss or attack. When something truly critical goes missing – whether due to accidental deletion, malicious insiders, or ransomware – these native tools are often insufficient for the quick, complete recovery required to keep your business running.

What Are Microsoft 365 Retention Policies and Legal Holds?

Definitions

• Retention Policy: Rules to keep or delete content for a specified time, set by compliance or business requirements. Applies to items in Exchange, SharePoint, OneDrive, and Teams.

• Legal Hold (Litigation Hold): Mandates that specific electronic data (like email or documents) be preserved for an indefinite period, overriding standard retention rules, usually triggered by a lawsuit or an investigation.

• Backup: An independent, immutable copy of business data, stored securely outside the original environment, enabling rapid, granular restorations after accidental loss, disaster, or attack.

Microsoft 365 Built-in Features

• Recycle Bin/Deleted Items: Short-term recovery (93 days max)

• Version History: Rollbacks for files (not always documents or entire libraries)

• Retention Policies: Customize how long various data types are kept

• Legal/Litigation Hold: Block removal of information during disputes/compliance cases

• Microsoft 365 Backup (native 2024 feature): Provides up to one year of retention and basic recovery

While these are useful for everyday mishaps or short-term needs, they don’t deliver the layered protection you need against sophisticated threats like ransomware, nor do they consistently fulfill regulatory retention periods for many industries.

Why Retention Isn't a Backup

• Data retained via policies is still stored inside Microsoft 365’s environment. If your tenant is compromised, attackers can often delete recovery points and disable holds.

• Retention policy restores can be slow and complex, often requiring eDiscovery expertise that most SMB teams lack.

• Long-term storage inflates your Microsoft 365 storage costs (overage is expensive), and some types of business data (metadata, permissions, site structures) aren’t protected at all.

• For many SMBs, legal hold only applies after legal counsel intervention, and still doesn’t safeguard data from deliberate, insider, or ransomware-driven destruction.

When Legal Hold and Retention Are Not Enough

Take, for example, periods of legal dispute or compliance audit. Legal hold can preserve data, but if a Microsoft 365 admin account is breached or if ransomware infects your cloud storage, both retention and legal hold can be subverted. True resilience requires backups hosted externally, with features such as immutable storage and multi-factor access lockout – essential for rapid, full recovery.

Why Ransomware Is a Real Threat for SMBs

Small organizations remain the preferred targets for ransomware criminals, precisely because they have limited IT resources. As we have seen at Interlock IT, recovering from ransomware is nearly impossible using only native retention tools if the attack goes undetected for weeks or months, which is increasingly common.

• Retention won’t save you if ransomware lies dormant and you only discover it after the 93-day window expires or after all recovery points are overwritten.

• Legal hold doesn’t help if attackers access admin controls and delete the very policies designed to protect you.

• Industry regulations (HIPAA for healthcare, CRA/IRS rules for accounting, etc.) mandate years of data retention – not achievable with default policies alone.

Step-by-Step: Building an Effective Microsoft 365 Backup Strategy

1. Assess Data Types and Compliance Requirements

• Document which Microsoft 365 apps store your most sensitive business records (e.g., email, financial docs, contracts, patient/client info)

• Determine the minimum regulatory retention timeframes for your industry (3-7 years is common)

2. Review Existing Policies and Holds

• Map active retention policies and legal holds in Exchange, SharePoint, Teams, and OneDrive

• Check for gaps: Are you only using recycle bin/version history? Does your retention match legal requirements?

3. Select a Backup Partner With True Cloud-to-Cloud Backup

A dedicated backup system, such as Afi.ai, creates immutable copies of your Microsoft 365 data stored securely outside Microsoft’s servers. This protects against even the worst-case tenant compromise and ransomware. Key criteria for SMBs:

• Independent backup storage with airtight separation from Microsoft 365 credentials

• Unlimited or configurable retention to match your actual compliance periods

• Granular recovery for Exchange, SharePoint, OneDrive, Teams, and groups

• Simple recovery workflows without advanced IT skills

• Automated, policy-based daily or more frequent backups

About AFI: Afi.ai: Your Trusted Partner in Cloud Data Protection

4. Implement and Test Your Backup Solution

• Schedule and automate backups for all users and sites

• Test recovery of both individual mailboxes/files and entire sites quarterly

• Document and update backup, restore and compliance processes as your business evolves

5. Combine Retention, Hold, and Backup for True Protection

Retain short-term business records via policy for easy access, use legal hold as needed during disputes, and rely on independent backup for long-term, disaster-proof recovery. This layered approach is the most resilient and cost-effective strategy for Canadian SMBs and beyond.

Risks of Relying Only on Retention or Legal Hold

• Exposure to high costs: Native retention uses up your pooled storage quota. Overages for additional storage in Microsoft 365 can cost hundreds per month per terabyte.

• Lack of point-in-time recovery: Legal hold and retention do not streamline quick restoration to just-before-loss state. Ransomware or admin errors can mean extended downtime if you lack a true backup.

• Complex recovery processes: Most small business IT admins find Microsoft 365 eDiscovery and legal hold navigation difficult and slow. In emergencies, speed matters.

Best Practices for Microsoft 365 Data Protection

• Always use at least basic recycle bin and version history, but recognize their time and scope limits

• Don’t rely on litigation hold or retention policy alone for disaster recovery or ransomware scenarios

• Choose a backup solution that offers off-platform, immutable storage and granular, fast recovery —Interlock IT can recommend, configure, and manage these for businesses of any size

• Test your full restore processes quarterly

• Integrate data protection into your full disaster recovery plan alongside business continuity procedures

FAQs: Microsoft 365 Retention, Legal Hold, and Backup

What is the native retention period in Microsoft 365?

Deleted items are kept for a maximum of 93 days in Microsoft 365 recycle bin by default. Custom retention policies and legal holds can extend this, but only with the right license (E3/E5) and proper configuration.

Does Microsoft 365 retention count as a backup?

No, retention policies store data on the same platform and are susceptible to tenant-wide attacks, admin deletions, and ransomware. Backup requires data to be stored outside of Microsoft 365 for independent recovery.

What’s the difference between legal hold and retention?

Legal hold preserves all data for users or sites indefinitely, required during legal actions regardless of standard policy. Retention policies follow business or regulatory timelines and can be adjusted or removed.

How can SMBs protect against ransomware in Microsoft 365?

The most effective solution is a dedicated, cloud-to-cloud backup with automated, frequent backups and immutable, isolated storage. Interlock IT specializes in tailoring these solutions for Canadian and US businesses.

Can retention or legal hold help with accidental deletions?

Yes, but only for a limited time and often with cumbersome restore processes. For quick, granular recovery, especially after major mistakes, a proper backup is superior.

Conclusion: Secure Your Microsoft 365 Data — Don’t Settle for Built-in Tools Only

While Microsoft 365’s retention and legal hold are valuable for compliance, neither is a full substitute for reliable, independent backup — especially as ransomware and regulatory scrutiny continue rising. As cloud and Microsoft experts with deep experience in the SMB sector, Interlock IT strongly recommends a layered approach: use all available native protection features, but make off-site cloud-to-cloud backup the cornerstone of your business continuity plan.

If you want guidance, configuration, or ongoing support for your Microsoft 365 backup, retention, or compliance needs, our cloud experts can help. You can reach us for a consultation or assessment at Interlock IT.

How to Read DMARC Reports and Fix Alignment Issues for Your Domain

 Protecting your domain from email spoofing and ensuring every message lands where it should start with understanding your DMARC reports. At Interlock IT, we’ve audited hundreds of domains and know firsthand how DMARC aggregate reports and alignment issues can make or break your email deliverability. If you want to read these reports effectively and fix SPF or DKIM alignment problems, it’s essential to interpret the data correctly and apply proven steps to resolve failures. This guide walks you through the process, answers key questions, and provides actionable best practices—straight from Canada's leading cloud services experts.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) reports give you daily insight into who’s sending email on your behalf, how messages are authenticated (SPF/DKIM), and highlight authentication failures or potential abuse. Many businesses find that reviewing these reports is crucial for blocking phishing attempts, maintaining brand reputation, and ensuring confident communication with their customers and partners.

What is a DMARC Report? A Concise Definition

A DMARC report is a standardized email report from recipient mail servers summarizing whether emails using your domain have passed SPF and DKIM authentication and alignment. Reports may be aggregate (group summaries) or forensic (individual failures), arriving as XML files—typically daily—when you publish a DMARC record in your DNS with a "rua" reporting address.

Why Reading DMARC Reports Matters

DMARC reports:

• Reveal all sources sending mail as your domain—including authorized services and potential spoofers

• Show pass/fail status for SPF, DKIM, and alignment (the critical check)

• Allow you to spot and fix configuration errors that could filter or block even legitimate business mail

Without proper interpretation, legitimate messaging platforms (newsletters, CRM, support systems) might fail DMARC alignment and be treated as spam—or worse, open the door for malicious actors to impersonate your brand. As Canada’s trusted DMARC audit partner, Interlock IT emphasizes that reading your DMARC reports is not just technical hygiene: it’s business-critical for small and medium enterprises.

Step-by-Step: How to Set Up and Receive DMARC Reports

1. Create Your DMARC Record: Add a TXT record at _dmarc.yourdomain.com in your DNS. Start with a monitoring policy, e.g.,
   v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. The rua address collects aggregate reports; ruf can collect forensic samples if needed.

2. Wait for DNS Propagation: Changes may take up to 24 hours. Use a DMARC checker tool to ensure your record is visible and correct.

3. Collect Reports: Mail providers (Google, Microsoft, Yahoo, etc.) will begin sending you DMARC reports as compressed XML files to your specified email address, usually within a day.

4. Use a DMARC Parsing Tool: Most raw XML files are unreadable for humans. At Interlock IT, our DMARC audit service parses and organizes this data into an actionable dashboard, saving many businesses hours of manual effort.

5. Review Regularly: Open your parsed dashboard (or DMARC XML, if you must) daily or weekly. Focus on volume trends, unknown senders, and failure rates for DKIM and SPF alignment.

Key Fields in Aggregate DMARC Reports

The structure and terminology of DMARC reports can appear daunting, but focusing on a few critical fields will provide actionable insights. Here’s a guide to the most important fields you’ll encounter:

Field	Description	Example	Action if Failing
source_ip	Sending mail server’s IP	192.0.2.45	Check ownership, verify if authorized
volume	Message count from this source	880	Investigate large volumes from unknowns
header_from	Domain in ‘From’ header	abc.ca	Ensure correct and aligned
SPF & SPF Alignment	SPF pass plus domain match	pass/pass	Fix record, align domains if failing
DKIM & DKIM Alignment	DKIM pass plus domain match	fail/fail	Configure DKIM, renew keys, enable relaxed or strict alignment as needed
DMARC Result	Comprehensive pass/fail	pass	Investigate cause if fail
Disposition	“none”, “quarantine” or “reject”	quarantine	Adjust policy or address misalignment

Alignment failures—where SPF or DKIM domains don't match your From address—are the most common cause of DMARC failures for legitimate email, and the ones we see most frequently at Interlock IT.

Troubleshooting: How to Fix Alignment Issues in DMARC Reports

Understanding Alignment

DMARC alignment means the domains used for SPF and DKIM authentication must either match your From domain (strict) or be a subdomain (relaxed) of it. Failing alignment is typically caused by:

• Third-party mailers (marketing tools, ticketing systems, payroll notifications) sending with their own Return-Path or DKIM signature

• Incorrect or outdated SPF/DKIM TXT records

• Forgotten or misconfigured domain aliases

1. SPF Alignment Issues

• Diagnosis: In your DMARC dashboard, you’ll see ‘SPF=pass but alignment=fail’ when the Return-Path domain (what bounces are sent to) differs from your visible From domain. For example, a marketing system sends on your behalf but uses their own domain for return-path.

• How to Fix:

1. Identify the sender/IP (the sending service provider).

2. Add or update the SPF TXT record with their include statement. For example, for Google Workspace and Microsoft 365:
   v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

3. Limit to 10 includes to avoid DNS query limits. Allow 24 hours for propagation and retest in your next DMARC report.

• Pro tip: For frequent forwarders or automated systems outside your control, use relaxed SPF alignment (aspf=r) in your DMARC policy.

2. DKIM Alignment Issues

• Diagnosis: If your DKIM fails or isn’t aligned, your mailer is either not signing with your domain’s DKIM key or the DNS key is outdated/missing.

• How to Fix:

1. Generate new DKIM keys within your platform (Google Workspace: Admin console > Apps > Authenticate email). Each platform provides a selector and key value.

2. Update your DNS with the provided selector and public key value.

3. Consider setting DMARC’s adkim=r for relaxed DKIM alignment if using subdomains or multiple apps.

4. Verify using email authentication testing tools, then review subsequent DMARC reports.

• Security Tip: Regularly rotate DKIM keys for ongoing security.

3. Unknown Sender or Spoofed IPs

• High numbers of emails from unfamiliar sources indicate either forwarding or active spoofing attempts.

• Audit and disable unauthorized sources, and ramp up DMARC policy from p=none to p=quarantine (test phase), eventually moving to p=reject for full protection.

Best Practices for Ongoing DMARC Alignment and Monitoring

• Start with p=none for monitoring; don’t quarantine or reject until confident about legitimate sender alignment

• Consolidate all sending platforms (marketing, CRM, ticketing, payroll) and update SPF/DKIM for each

• Review parsed reports weekly or monthly for surprises

• Gradually enforce stricter policies as all regular communication is passing

• Contact an expert team, like Interlock IT, for ongoing audits or complex multi-domain setups

• Document all changes and keep historical DMARC compliance trends

Frequently Asked Questions: DMARC Reports and Alignment

What is the difference between SPF and DKIM alignment in DMARC?

SPF alignment requires the Return-Path domain to match or be a subdomain of the visible From domain. DKIM alignment checks that the domain signing the message with DKIM also matches the From domain. Both alignments must pass for DMARC success when operating in strict mode.

Why do I see passing SPF but failing alignment?

This happens when a third-party service is authorized in your SPF record but uses its own Return-Path (not your domain). Update the service to send with your domain as Return-Path, or relax SMARC alignment policy (set aspf=r).

Can I use multiple ESPs like Microsoft 365 and Google Workspace together?

Yes, but you must include both in your SPF record, and configure DKIM for both in each provider’s admin console.

How does policy enforcement work?

Start with p=none and monitor all issues. Once confident 90%+ of legitimate email is authenticated and aligned, progress to p=quarantine (test policy), then to p=reject for full enforcement and maximum protection. See our guide on DMARC enforcement timing.

Are forwarded emails always a problem?

No, but forwarded mail can break SPF or DKIM, causing alignment failures. Using relaxed DMARC alignment, or ensuring DKIM survives forwarding, can mitigate most issues.

How can I automate or outsource DMARC reporting?

Third-party DMARC report parsers or managed services can simplify this process. At Interlock IT, we audit, parse, and translate your DMARC data so you focus on business priorities instead of chasing down mail errors.

What if my reports show high-volume failures from unknown sources?

This typically signals domain spoofing or unauthorized relay. Audit all legitimate mailers, ramp up your enforcement policy, and consider locking down mail streams by IP if necessary. Immediate action can greatly reduce risk.

Conclusion

Reading DMARC reports and resolving alignment issues are essential to keeping your communications secure and trusted. As the authoritative DMARC audit partner in Canada, Interlock IT simplifies every aspect—parsing reports, updating records, and offering expert advice with deep Google Workspace and Microsoft 365 integration experience. We encourage every business leader to review their DMARC setup and invite you to reach out for an audit if you’re ready to reduce risk and improve deliverability.

For deeper guidance on rollout strategies, see our DMARC Audit Checklist for Small Businesses and related posts on protecting your business email. For a personalized consultation or DMARC audit, connect with us at https://www.interlockit.com.