Troubleshooting Migration

Before the start of the migration process, and after the completion of migration, you might encounter issues with the migration. This can happen in cases where the source server details that you provided might be invalid, the emails in your previous email account might not be in check with the RFC standards. 

Before Migration

Certain factors need to be checked before you perform migration for users. One of the basic errors occurs while your previous email account is being authenticated. 

General Authentication Errors

• Make sure that the user has not changed the password of the source account when you run the migration.
• The access to the old server is still in place for the account, until the migration is completed.

Troubleshoot Microsoft 365 migration errors

Errors while migrating from a Microsoft 365/ Exchange environment can be due to security or role restrictions in your Microsoft Admin Center. Some of the known errors are:

• ApplicationImpersonation role
• Invalid user error
• Whitelist IP addresses

ApplicationImpersonation role

The ApplicationImpersonation enables applications to impersonate users in an organization in order to perform tasks on behalf of a user (such as migration). Microsoft announced the deprecation of ApplicationImpersonation role starting in February 2025. However, if you face errors during migration, you can try assigning this role to the admin by following these steps.

Below are the steps to grant ApplicationImpersonation role for users:

1. Log in to the Microsoft 365 Exchange Admin Portal.
2. Navigate to Admin roles under the Roles section.
3. Click Add role group and enter a name for the role.
4. If required, add a description for the role and click Next.
5. In the Add permissions page, select ApplicationImpersonation and click Next.
6. Add the users to whom you want to assign this role.
7. Click Next and select Add role group.
8. After you have added the role group, click Done.

You have now successfully created the ApplicationImpersonation role in Microsoft 365. Please wait for some time for the changes to propagate. If you try to add a migration immediately after configuring, your credentials might fail.

Invalid User Error

When you create a migration from Microsoft 365/ Exchange, you might get an Invalid User Details error. This is due to one of the following settings in your Microsoft 365 account:

• Two-Factor Authentication (TFA) - If TFA is enabled, you might require to enter an application-specific password to authenticate your account.
• Changes to security settings in the Microsoft account - Due to recent security updates from Microsoft 365, we recommend you to Disable Security Defaults and Modern Authentication for your Microsoft account.
• Basic authentication is turned off - Turn on Basic Authentication for all protocols.​

Whitelist Zoho Mail IP addresses

Your source account access may be blocked upon detection of activity from new IP Addresses. Log in to your Microsoft 365 admin account and allow access to the Zoho Mail IP addresses, listed there under Recent Activity. Select 'This was me' to trust the Zoho Mail IP addresses and proceed with the migration.

Troubleshoot Google Workspace migration errors

In case you are migrating from Google Workspace/ Google Apps servers, you may have to log in via the web once to authenticate the IMAP activity in your account. In this case, request the user to login to the Google Apps account from web and follow the steps listed on this help page for the error 'Web login required': https://support.google.com/mail/answer/78754.

While migrating from Google Workspace, you might face few authentication errors. This is due to the settings in Google cloud admin console. Below are the common errors faced during migration:

• Service Account Key creation disabled
• Google Cloud Platform service disabled
• Organization Policy Administrator role not listed

Service Account Key creation disabled

Under Google Workspace migration, if you are facing the error message as "iam.serviceaccountkeys create is disabled", then it is due to a policy that restricts you from creating service accounts key. Follow the below steps to disable the policy:

1. Log in to the Google cloud console as an admin.
2. Click the project picker box available next to Google Cloud Logo.
3. Navigate to ALL tab under Select a resource dialog box.
4. Select the desired organization from the list.
   
5. If you have already created a project, select your preferred project listed below the organization.
6. If a project is not created, click NEW PROJECT on the top right corner of the Select a resource dialog box.
7. Click Google cloud icon to go to the Google Cloud home page.
8. Go to IAM and admin section and select Permissions tab. All the permissions applicable for your organization will be listed.
9. Click the View by Principals tab and select the check box against your project name. Now click GRANT ACCESS.
10. Enter the super admin email address in "New Principals" field under Add principals section.

11. Select Organization policy Administrator from the drop-down of Select a role under the Assign Roles section and click Save.

    Note:
    If you do not find the Organization Policy administrator role in the drop-down list, follow the steps mentioned here.
12. Navigate to the Organizational policies on the left pane of IAM and Admin section and the list of policies are populated.
13. Scroll down to find and click "Disable service account key creation".
14. Click the edit icon next to the Manage Policy on the top right corner of Policy details page.
15. Under Rules section, click on Enforced and select OFF.
16. Click Done and then click Set Policy.

Now, you can generate key for the service account.

For further guidelines, visit the Google service accounts key help page.

Google Cloud Platform service disabled

During migration of data, when a user is trying to authorize using the Google Developers Console, they might face an error stating "Google Cloud Platform service has been disabled. Please contact your administrator to turn the service on in the Google Workspace Admin console". Here, the customer needs to allow users to create projects to overcome this error.
Follow the below steps to enable users to create projects:

1. Log in to Google Admin Console.
2. Navigate to Apps.
3. Select Additional Google Services.
4. Choose Google Cloud Platform.
5. Select the organization name from where the emails are migrated.
6. Go to the Cloud Resource Manager API settings and select the checkbox "Allow users to create projects".

For more details, visit the Google help page to enable-disable services.

Organization Policy Administrator role not listed

Some of the Google Workspace account users might not have the "Organization Policy Administrator" role listed under the roles drop-down. Follow the below steps in such cases:

1. Open Google developer console.
2. Navigate to Manage Resources on the left pane.
3. Select your organization listed under Resources.
4. Click Add Principal on the right pane under Permissions tab.
5. Enter the admin email id for that organization in the New Principals field.
6. Select Organization Policy Administrator from the drop-down listed under the Select a role field of the Assign roles section and click Save.
7. Click the menu icon next to Google Cloud logo in the home page and navigate to IAM & Admin on the left pane.
8. Select Organization Policies from the list under IAM & Admin option.
9. Select your organization name under Select a Resource dialog box, and all the policies associated with it will be displayed.
10. Choose the Filter icon and enter "key" as the search word. The matching policies will be listed.
11. Select the below options under the policies listed:
    • Disable service account key creation
    • Disable service account key upload
12. Select the edit icon next to Manage Policy.
13. Click on Enforced and select OFF under Rules section of the Edit policy page.
14. Select Done and then click Set Policy.

Visit the Google help page for creating and managing organization policies.

After Migration

After the migration is completed for the scheduled users, the reports and the details of the migration can be viewed in the Accounts section in case of POP/IMAP migration, and from the View Reports section after the login screen in the Zoho Mail Migration wizard.

POP / IMAP Migration

Once the migration process is complete, you can view the statistics and the other migration details by clicking on the respective migration from the Migration Listing.

1. You can view the overall migration status in the listing, and detailed migration status in the Accounts section.
2. For IMAP Migration, detailed statistics along with folder information will be available.
3. You can click on a specific user to view their migration statistics.
4. Under each account, the errors, if any, will also be listed with details.
5. The common reasons include:
   • Email Size Exceeded  - If the size of the email in the source server exceeds the maximum size defined in the user's email policy, such emails will not be migrated.
   • Mail already present - If the email is a duplicate of an email already in the user's account in Zoho, the duplicate emails will not be migrated.
   • Too many addresses - If the number of To Addresses in an email exceeds the permitted limit in Zoho Mail, the email will not be migrated.
   • Invalid Message  - If the email format is not as per the RFC definitions, with an incorrect header or email format, such emails will not be migrated.
   • Unable to Process - In case there are any internal processing errors during the migration of a particular email, such emails will be skipped during migration.
   • Unable to Retrieve - At times, there might be some problems while fetching certain emails from the source server. Emails that could not be retrieved from the source server will be categorized here.​
6. Apart from the migration statistics, the administrator and the users will receive a summary of migration information after the completion.

In case of some failures like Internal Errors, the administrator can migrate only selective folders instead of entire migration. This will optimize the runtime for the migration, by removing the duplicates and the check for duplicate emails. 

Migrating using the Migration wizard 

If you're migrating from your previous email provider using the Migration wizard, you can view the migration statistics and finer details from the Reports section.

Migration Reports

Reports can be viewed for those accounts that have been migrated. They can be accessed by clicking on the 'View Reports' button after the login screen.

Steps to view Reports

1. Log in using your Zoho account Credentials from which you scheduled the migration, in the User Login page of the migration wizard.
2. After you log in, click on the 'View Reports' button on the left bottom corner.
3. The Migration Report window opens on a screen.
   ​​
4. The 'Migration' dropdown lists all the migrations performed by that user. Select the migration for which you want to view the reports.
5. After selecting the migration, the 'User' dropdown lists all the users whose PSTs were migrated in that migration.
6. Select the user whose reports you want to view.
7. In the 'PST List' dropdown, choose the required PST file.
8. The Status section shows if the migration was scheduled for that app and if it is completed or failed.
9. A table containing the details of each folder along with the stats will also be displayed. 

Migration Suspension

During the process of migration, if the size of the emails migrated in the account, exceeds the allowed storage, the incoming emails may get blocked. Hence to avoid this, if the account reaches 80% of the allowed storage, the migration gets suspended(paused) temporarily. You can create more space either by deleting some of the old or unwanted emails in your previous account or by purchasing additional storage for your Zoho account.

Once you are confident that the account has enough space, you can resume the migration.