There are 2 types of issues you might see when using the data migration service—blocking and non-blocking.
Blocking issues
Blocking issues prevent the migration of user accounts. They usually occur if you specify an incorrect username or password when you set up migrations from IMAP environments. Or, you might get them if your Microsoft Exchange administrator account lacks certain privileges.
How to fix blocking issues
Expand section | Collapse all & go to top
Migrating from an EWS environment (Exchange 2007 & later)If you encounter problems when migrating from a Microsoft Exchange Web Services (EWS) environment, verify:
Step 1: Servers can reach and recognize EWS
Select the Synchronization, Notification, Availability, and Automatic Replies option on the Exchange Server tab in the Microsoft Remote Connectivity Analyzer tool to verify that servers can reach and, through the Autodiscover service, recognize EWS.
Step 2: The logs show the data migration service can communicate with Exchange
Check the Exchange server Internet Information Services (IIS) logs for the SyncFolderItems call with response code 200.
Step 3: AD Conditional Access policies
Check whether you’re using Conditional Access policies on your Microsoft Active Directory. If so, turn off the policies and try migrating again. For more information, consult your Microsoft documentation.
Step 4: Exchange impersonation
For more information, consult your Microsoft documentation on how to set up Exchange impersonation.
Step 5: TLS certificates
Verify your TLS certificates are signed and valid. For details, go to Set up your TLS certificate.
Step 6: Exchange user account
Verify the Exchange user account is a valid account and the mailbox is turned on. Also, check that the Exchange mailbox isn't corrupt.
Step 7: Migration client ID
Verify that the following service account client ID appears in the list of clients that have access to mail and migration APIs:
955661971872-ie97v0ns6ndb19rbr9nlpkahpmfk9ugf.apps.googleusercontent.com
To check the client ID:
-
Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).
-
In the Admin console, go to Menu SecurityAccess and data controlAPI controlsManage Domain Wide Delegation.
You must be signed in as a super administrator for this task. - The client ID should be listed under API clients.
- If the client ID isn't listed, click Add new and enter the following ID:
955661971872-ie97v0ns6ndb19rbr9nlpkahpmfk9ugf.apps.googleusercontent.com
-
For OAuth scopes, copy and paste the following comma-delimited list of scopes:
https://mail.google.com/,
https://googleapis.com/auth/email.migration,
https://googleapis.com/auth/gmail.insert,
https://googleapis.com/auth/gmail.labels - Click Authorize.
-
Point to the new client ID, click View details, and make sure that every scope is listed.
If a scope is not listed, click Edit, enter the missing scope, and click Authorize. You can't edit the client ID.
Step 8: The relevant Google service
Check that you turned on the target Google service (Gmail, Contacts, or Calendar). For details, go to Turn a service on or off for Google Workspace users.
Step 9: The super administrator
Check that a super administrator is assigned to the Google Workspace domain.
Step 10: Server gets connections from Google mail servers
For details, go to Google IP address ranges for outbound mail servers.
Blocking issues when migrating from an IMAP server, Gmail, or a Google Workspace account might indicate an obstacle accessing the mailbox. Try to access the mailbox using an IMAP email client such as Mozilla Thunderbird, Apple Mail, or Microsoft Outlook. Doing so ensures the mailbox has IMAP access and that you have the correct username and password.
If you still have issues, confirm:
Step 1: Migration client ID
Verify the following service account client ID appears in the list of clients that have access to mail and migration APIs:
955661971872-ie97v0ns6ndb19rbr9nlpkahpmfk9ugf.apps.googleusercontent.com
To check the client ID:
-
Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).
-
In the Admin console, go to Menu SecurityAccess and data controlAPI controlsManage Domain Wide Delegation.
You must be signed in as a super administrator for this task. - The client ID should be listed under API clients.
- If the client ID is not listed, click Add new and enter 955661971872-ie97v0ns6ndb19rbr9nlpkahpmfk9ugf.apps.googleusercontent.com.
- For OAuth scopes, copy and paste the following comma-delimited list of scopes:
https://mail.google.com/,
https://googleapis.com/auth/email.migration,
https://googleapis.com/auth/gmail.insert,
https://googleapis.com/auth/gmail.labels - Click Authorize.
-
Point to the new client ID, click View details, and make sure that every scope is listed.
If a scope is not listed, click Edit, enter the missing scope, and click Authorize. You can't edit the client ID.
Step 2: The relevant Google service is turned on
Check that you turned on the target Google service (Gmail, Contacts, or Calendar). For details, go to Turn a service on or off for Google Workspace users.
Step 3: A super administrator is assigned
Check that a super administrator is assigned to the Google Workspace domain.
Step 4: Your server gets connections from Google mail servers
For details, go to Google IP address ranges for outbound mail servers.
Non-blocking issues
Non-blocking issues prevent some, but not all, messages from migrating. You might have message-level errors (where a single message hasn't migrated correctly) or folder-level errors (where an entire folder hasn't migrated).
How to fix non-blocking issues
If non-blocking issues or errors occur, request a domain migration and item error report. Then, try these troubleshooting steps.
For details on migration reports, go to Monitor a data move.
Expand section | Collapse all & go to top
Troubleshoot missing messagesStep 1: Verify message is missing
- Follow the instructions in Why is the number of messages greater than the items migrated?
- If there are still messages missing, continue to step 2.
Step 2: Check setup steps
Check that you completed the steps in Prepare your source account.
Step 3: Search for email header
Make sure a message isn't mislabeled:
- Get the message-ID of a missing message from the source account. You can find the message-ID in the message header.
For details, go to Trace an email with its full headers.
- In the new account, use the rfc822msgid: Gmail search operator to search for the message-ID.
For details on using a search operator, go to Search operators you can use with Gmail.
- If the message can't be found in the new account, continue to step 4.
Step 4: Check error report
- Locate the item error report.
For details, go to Monitor a migration.
- If the message shows as failed in the report, go to Data migration service error messages and follow the instructions for the corresponding error message.
- If the message isn't in the report and you're migrating from Gmail or Google Workspace, make sure that the mailbox on the source account:
- Doesn't have an IMAP folder size limit
- Shows all labels in IMAP
For details, go to Get email from another email platform.
If you have an email folder missing after a migration, contact your source email service provider for help with resolving the issue with the folder.
If the issue can’t be resolved, you could delete the folder and run the migration again. Any email messages contained within the folder are also deleted, however.
Related topics
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.