Exchange Online Migration for NHS Trusts: Step-by-Step Implementation Guide UK 2026
Why Exchange Online migration matters for NHS trusts
Moving from on-premises Exchange Server to Microsoft 365's Exchange Online is no longer optional for most NHS trusts. It's an active requirement embedded in NHS Digital's cloud modernisation strategy and the Health and Social Care Act compliance framework. Unlike a commercial business migration, NHS trusts face uniquely tight constraints: patient data sensitivity under GDPR and UK Data Protection Act 2018, audit trails for Care Quality Commission inspections, integration with existing NHS systems like Epic or Cerner, and the need to maintain service continuity during weekend-only maintenance windows.
If your trust is still running Exchange Server 2016 or earlier, you're now in genuine technical debt. Extended Support for Exchange Server 2016 ends on 13 October 2026, and Microsoft has already stopped patching older versions. But the real pressure isn't the deadline. It's the operational risk: unsupported servers mean security vulnerabilities, compliance audits become nightmares, and if a ransomware incident hits an unsupported mailbox system, your trust's insurer may not cover it.
Understanding the three migration approaches
Hybrid coexistence (the safe middle ground)
Hybrid Exchange means running on-premises Exchange Server and Exchange Online at the same time, with mailboxes gradually moving over weeks or months. Your on-premises server acts as the relay point, and users can work normally during the transition. This is the approach most NHS trusts choose, and for good reason.
The hybrid setup lets you test Exchange Online in your live environment before committing. You can migrate high-volume departments like administration first, watch their experience, then move clinical departments. If something breaks, you can move a mailbox back on-premises in minutes.
Setup takes roughly 2 to 4 weeks for a trust of 500+ users, assuming your IT team has Microsoft 365 licensing sorted and your network connectivity is already modern. You'll need a hybrid server (which can be an existing on-premises Exchange instance or a small dedicated machine), and your firewall must allow outbound HTTPS on port 443 to Microsoft datacentres.
Cutover migration (fast but risky)
Cutover means moving all mailboxes at once, usually over a single weekend. You shut down on-premises Exchange, move everything to Exchange Online, and switch over DNS. Users come back Monday morning to a cloud-only system.
This works for smaller trusts (under 150 mailboxes) but is genuinely risky for larger ones. If something fails on Monday morning, you don't have a quick rollback. Clinical staff can't access patient correspondence. Your trust is in breach of CQC service continuity requirements. One NHS trust cutover in 2023 resulted in 72 hours of partial outages because a distribution list wasn't properly migrated, and the reputational damage lasted months.
IMAP migration (legacy workaround)
IMAP is the slowest option, migrating mail profile by profile. It's only used when hybrid isn't possible, such as on very old unsupported networks or when an on-premises Exchange server has failed and can't be recovered. Avoid it if possible. It typically takes months and creates a nightmare for IT support, because users end up with partial mailbox histories and no shared calendars or public folders.
The NHS compliance layer: what's different
Standard Microsoft 365 deployments can usually ignore certain security settings. NHS trusts cannot.
Your deployment must include:
These aren't optional extras. Your trust's Data Protection Impact Assessment (DPIA) will require them before you switch on. Most NHS trusts spend 4 to 6 weeks just on the compliance configuration and testing phase, before any user mailbox moves.
If your trust hasn't done a DPIA yet, start now. It's a genuine bottleneck.
The practical migration timeline
Pre-migration (weeks 1 to 4)
Audit your current Exchange setup. How many mailboxes? What's the total mailbox size? Are there shared mailboxes, distribution lists, or public folders? How many users access mail via the old Outlook Web Access?
Create a detailed inventory in a spreadsheet. You'll need this to estimate bandwidth, predict cutover windows and identify users who may have extremely large or unusual mailbox configurations. One trust discovered a 2GB mailbox of archived attachments that had never been archived properly. Planning around that changed their entire phasing strategy.
Check your network. Exchange Online works best with at least 10Mbps upload bandwidth per 100 concurrent users. If your trust has a single 50Mbps internet link and 800 users, migration day will be slow. Your IT team may need to provisionally increase connectivity before cutover.
Pilot phase (weeks 5 to 8)
Set up hybrid Exchange. Migrate a small group of users, perhaps 20 from IT, Admin, and one clinical department. Test everything:
This is not theoretical. One trust's pilot revealed that their clinic management system couldn't update calendar free-busy information in the cloud, which broke appointment booking. They had to configure a workaround with Exchange Web Services (EWS). That took two weeks and almost derailed the entire migration.
Staged migration (weeks 9 onwards)
Move departments in waves. Typically: IT and administrative staff first, then back-office departments, then clinical teams. Allocate at least 2 to 3 weeks per wave, including user training, support desk preparation, and monitoring.
Your support desk needs to be trained on Exchange Online before users arrive. Basic issues like "my calendar won't sync" or "I can't find the archived mail folder" will flood the helpdesk. The NHS trusts that prepared helpdesk staff in advance had vastly fewer escalations.
Post-migration (weeks variable)
Once all mailboxes are moved and stable for two weeks, you can decommission the on-premises Exchange server. Don't rush this. Keep it for at least 30 days as a backup, in case you need to recover archived data or verify that nothing was missed.
Common pitfalls and how to avoid them
Public folders: Many NHS trusts have old public folder hierarchies with shared documents, policies, or historical records. Exchange Online handles public folders differently. You must plan for this explicitly. Most trusts either migrate public folders to Teams or SharePoint (preferred) or accept that they'll be read-only archives.
Large mailboxes: If a user has a 10GB mailbox, migration takes a long time and can timeout. Archive old mail before migration. Most NHS trusts implement an archiving policy requiring users to move emails over two years old before cutover.
Mobile device access: Existing mobile device configurations won't work with Exchange Online unless they're updated. This sounds obvious but many trusts only discover this when their surgical team loses mail access on their phones the day after cutover. Prepare a mobile device setup guide and distribute it to users before migration.
Legacy distribution lists: If you have 200+ distribution lists with complex membership, test them thoroughly. Nested lists sometimes don't migrate correctly. Audit each one after migration.
What the cost actually looks like
Microsoft 365 licensing for NHS trusts typically runs £4.50 to £6.50 per user per month through NHS-negotiated rates, depending on your package. For a 500-user trust, that's roughly £27,000 to £39,000 per year.
The hidden cost is project management and testing. Most NHS trusts allocate 200 to 400 hours of IT staff time to a full migration (not counting helpdesk training and post-cutover support). If your IT team is stretched, you may need to contract external migration consultants, which adds another £15,000 to £30,000 to the project.
Your trust should budget for this. If you're unfamiliar with Exchange Online or have never managed a cloud migration before, now is the time to build your skills.
If you're an NHS IT professional preparing for migration and want to understand the cloud infrastructure decisions behind Exchange Online better, SmoothOps 365 offers a Microsoft 365 Administrator Programme designed explicitly for healthcare IT teams moving to cloud services. It covers Exchange Online configuration, security policies, and compliance as core modules, with hands-on labs you can practise on real NHS-style scenarios. The programme is coming soon, but you can join the waitlist to get priority access and exclusive NHS migrant resources when it launches.
Frequently asked questions
What's the difference between hybrid migration and cutover for NHS trusts?
Hybrid migration runs your on-premises Exchange and Exchange Online in parallel, letting you move mailboxes gradually over weeks. Cutover moves everything at once, usually over a weekend. Hybrid is much safer for NHS trusts because it lets you test, phase by department and rollback if needed, but it takes longer. Cutover is faster but carries high risk of prolonged outages, which violates CQC service continuity standards.
Do I need to buy new Microsoft 365 licenses before starting?
Yes. Your trust needs to purchase Microsoft 365 licenses (typically Microsoft 365 Business Standard or Enterprise E3) for every user before any mailbox can move to Exchange Online. Licensing is usually negotiated through NHS Digital's Crown Commercial Service framework, which takes 2 to 4 weeks. You should order licenses before you begin your pilot phase, not during it.
How long does an NHS trust migration typically take from start to finish?
A typical NHS trust migration takes 12 to 20 weeks from initial planning to decommissioning the old server, depending on trust size, complexity and the number of legacy integrations. This includes compliance planning (4 to 6 weeks), pilot testing (4 weeks), staged user migration (6 to 10 weeks) and post-migration validation (2 to 4 weeks). Smaller trusts under 200 users might do it in 8 to 10 weeks.
What happens to our archived mail and public folders in Exchange Online?
Public folders must be migrated separately to Exchange Online or converted to Teams/SharePoint (the recommended approach). Archived mail can move with user mailboxes but should be cleaned up first to reduce migration time. You should conduct an audit before cutover to decide whether archived mail is worth migrating or can be decommissioned as part of the project.
Do we need to reconfigure all user devices to access Exchange Online?
Mobile devices and desktop mail clients need reconfiguration, but for modern setups it's usually straightforward. Outlook on Windows and Mac updates automatically. Mobile devices need the mail app reconfigured with modern authentication details. Your support team should prepare setup guides and test on a few devices before the wider rollout.
SmoothOps 365 runs live instructor-led training every Saturday and Sunday. 3 months. 50 contact hours. Keep your job while you train.