Migrations into Exchange Online that don't go through an Exchange hybrid deployment fail with their own set of messages: IMAP endpoints that time out, CSV files the wizard rejects, Outlook Anywhere errors in a cutover, Gmail sign-in failures and numbered codes from cross-tenant moves. This quick reference lists the documented messages with the meaning, the usual cause and the first thing to check.
Codes in this quick reference
The connection to the server imap.contoso.com could not be completed: IMAP server name doesn't resolveEAC (new IMAP endpoint or batch)The connection to the server Servername.contoso.com timed out after 00:00:15: IMAP port not reachableEAC (new IMAP endpoint or batch)Upload file can't be emptyEAC (CSV upload)The CSV file contains more than 50,000 rows. Please divide the file into two or more filesEAC (CSV upload)Column "<name>" is missing from the CSV file. The import process can't continue because this column is required.EAC (CSV upload)Row X has the wrong number of columns. Expected number: 3. Actual number: Y.EAC (CSV upload)The migration batch already exists.EAC / New-MigrationBatchA recipient wasn't found for user@contoso.com on the target: no Exchange Online mailbox with that addressMigration user error report
+ 30 more codes in the tables below.
How to read these errors#
IMAP, cutover and Google Workspace migrations all run as migration batches under Migration in the Exchange admin center (EAC). Errors appear at three points:
- Creating the endpoint or batch: the EAC wizard (or
New-MigrationEndpointandNew-MigrationBatch) rejects the settings or the CSV file. - Per user, after the batch starts: the user's details in the batch, the
ErrorSummaryin PowerShell, or (for IMAP) the report linked from the emailE-mail migration batch "Batch name" has finished - with errors. - Orchestrated cross-tenant migrations: messages prefixed with a code such as
MIGR-002,CTM-100orEXCH-08.
PowerShell
Get-MigrationBatch | Format-List Identity, Status, *Count
Get-MigrationUser -BatchId "IMAP-Wave1" -Status Failed | Format-List Identity, ErrorSummary
Get-MigrationUserStatistics -Identity user@contoso.com -IncludeReport | Format-List Status, ErrorSummary, ReportNot repeated here: moves from Exchange Server in a hybrid deployment (MRSProxy and endpoint errors, StalledDueToTarget states, bad items, DataConsistencyScore, Synced with errors). They're in the mailbox move and migration errors reference and the hybrid migration batches guide. For connecting to PowerShell, see Exchange Online PowerShell connection errors.
IMAP migrations#
Creating the endpoint, CSV or batch#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The connection to the server imap.contoso.com could not be completed. | Exchange Online can't reach the IMAP server name you entered | The FQDN is wrong or doesn't resolve in public DNS, including an old endpoint whose name stopped resolving | Resolve the name from outside your network; recreate the endpoint with a public FQDN |
The connection to the server Servername.contoso.com timed out after 00:00:15. | No answer on the IMAP port | A firewall blocks Microsoft datacenter addresses on 993 or 143, or the IMAP service is stopped | telnet server 993 from outside; on Exchange, the Microsoft Exchange IMAP4 service |
Upload file can't be empty | The CSV has no data | The wrong or a blank file | The file you selected |
The CSV file contains more than 50,000 rows. | Over the CSV limit | A CSV can hold up to 50,000 rows and 10 MB | Split the users into smaller batches |
Column "<name>" is missing from the CSV file. | A required header is missing | IMAP needs EmailAddress, UserName and Password in the first row | The header spelling |
Row X has the wrong number of columns. Expected number: 3. Actual number: Y. | A row is incomplete | A missing value or an extra comma | That row of the file |
The migration batch already exists. | Batch names must be unique | An existing batch, or a deleted one that's still being removed | Use a new name, or wait a few minutes after deleting |
Per-user errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
A recipient wasn't found for user@contoso.com on the target. Create a recipient of the appropriate type for this migration on the target and try again. | No Exchange Online mailbox has that address | The mailbox doesn't exist yet, EmailAddress is wrong, or the row is a group or another non-mailbox object | Create the mailbox, or set EmailAddress to one of its proxy addresses |
We had trouble signing in to this account. Confirm that you're using the correct user name and password. | The IMAP server rejected the sign-in | Wrong credentials in the CSV, IMAP turned off for the organization or user, or a super-user account without rights | The CSV; IMAP access at both levels; on Exchange the account needs Full Access, Receive As on the database, or Domain Admins |
This mailbox is full. Please free up some space so that email can be downloaded. | The Exchange Online mailbox reached its quota | From Gmail, often duplicates caused by labels or a [Gmail] folder that wasn't excluded | Exclude [Gmail], remove labels, delete the duplicates and re-create the batch |
Limits that look like failures: IMAP moves only mail folders (no contacts, calendar or tasks), up to 500,000 items per mailbox and messages up to 35 MB. IMAP from Exchange Server 2010 fails at the endpoint, because its IMAP service only offers TLS 1.0 and Exchange Online requires TLS 1.2; use cutover, hybrid or PST import instead. The endpoint's default of 20 concurrent migrations can be raised to 100.
Google Workspace and Gmail#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
MigrationPermanentException: Special credentials are required in order to access this IMAP account. with Application-specific password required | Google refused the password in the CSV | An IMAP-based Gmail migration where the account needs an app password | Put an app password in the Password column, then select Resume migration for the user |
The Google Workspace migration type doesn't use passwords: it signs in with a service account and its JSON key, and the CSV needs only EmailAddress. Endpoint or batch failures there usually trace back to Google-side setup. Microsoft warns that a mistyped OAuth scope list makes the batch fail later, after it starts, and that delegation changes can take 15 minutes to 24 hours to apply. Targets must already exist as mail users, and messages that retention or archiving tools delete or archive during the move are flagged as missing. Google Workspace migration isn't available for GCC High or DoD.
Cutover migrations#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
MigrationTransientException: We weren't able to connect to the remote server. Please verify that the migration endpoint settings are correct and your certificate is valid | The cutover endpoint wasn't created | Outlook Anywhere authentication or RPC proxy settings are wrong | Outlook Anywhere client authentication set to Basic, then the test below |
Microsoft.Exchange.Rpc.ServerUnavailableException: Error 0x6ba (The RPC server is unavailable) from cli_NspiBind | The inner error: the address book connection through the RPC proxy failed | RPC proxy ports, or domain controllers not listening on port 6004 | The RPC proxy configuration and port 6004 |
"/o=NT5/ou=.../cn=..." is not a valid SMTP address | The batch contains an invalid recipient address | Stale or invalid GAL entries in the source organization | Update-GlobalAddressList -Identity "Default Global Address List" -DomainController <DC> on-premises, then delete and re-create the batch |
Cross-tenant migrations#
Microsoft documents numbered codes for its orchestrated tenant-to-tenant migration, which moves mailboxes after identity mapping and can also move OneDrive and Teams data (those codes aren't listed here). The EXCH codes rest on the same pieces as a classic cross-tenant move started with New-MigrationBatch, so their causes are worth checking for both: organization relationships in both tenants, the migration app, a mail-enabled security group that scopes who may move, a migration endpoint in the target, a target mail user carrying the source ExchangeGuid and ArchiveGuid, and a Cross-Tenant User Data Migration license.
Authorization, identity mapping and mailbox moves#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
MIGR-001 | Tenant authorization error. The tenants are not configured to support migration. | The organization relationship is wrong | Both organization relationships |
MIGR-002 | User migration failed. User <X> is not authorized to migrate. | Not in the source scoping group | Add the user to the group, retry |
MIGR-003 | User [X] migration failed. Please retry user migration. | A failure the service asks you to retry | Retry the user |
MIGR-004 | Authorization error | Organization relationship, group membership, or both | Both settings |
IM-003 | User migration failed. User <X> is not mapped to an identity on tenant <Y>. | Not added to identity mapping | Add and map the user, retry |
CTM-001 / CTM-002 | User migration validation failed. User is already a part of the same batch (or of another running batch) | Duplicate submission | None |
CTM-100 | User migration validation failed. User identity mapping not found. | No mapping for the user | Rerun identity mapping |
CTM-101 | User migration validation failed. User identity mapping not in completed state. | Mapping started but not finished | Wait, or complete the mapping steps |
CTM-102 / CTM-103 | Service busy, or an internal error during validation | Service side | Resubmit in a later batch; contact support if CTM-103 persists |
CTM-104 | The CTMS and/or CTIM Apps are either not provisioned, not enabled, or not fully configured. | Incomplete tenant setup | Rerun the CTMS setup script |
EXCH-07 | No valid migration endpoints for the remote tenant. | Misspelled endpoint name in the input JSON, or no tenant-to-tenant endpoint for that source | Get-MigrationEndpoint in the target |
EXCH-08 | Setup validation failed, or The connection to the server outlook.office.com could not be completed. | Target missing or lacking ExchangeGuid or ArchiveGuid; GUID mismatch; source not in scope; litigation hold without an exception; source over quota; stale MailboxMoveRemoteHostName; OAuth app; license; soft-deleted objects | Test-MigrationServerAvailability for the user (below) and Microsoft's Cross Tenant Mailbox Migration Validation script |
EXCH-13 | Mailbox migration for user {0} has already completed in another batch | Resubmitted user | None |
EXCH-15 | Max retry for user with id {0} reached. | Possibly a service-side issue | New batch; contact support if it repeats |
EXCH-23 | Max Test-MigrationServerAvailability retry for user with id {0} reached. | The EXCH-08 causes | Endpoint, organization relationship, scope |
EXCH-24 | No license was found for the source recipient or the target recipient | No Cross-Tenant User Data Migration license | Assign it, retry |
EXCH-25 / EXCH-26 | Cannot delete ongoing migration for user {0} / Delete request for batch {0} failed. | Deleting too early, or an incomplete purge | Complete or cancel first; retry the deletion |
Identity mapping messages#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
ExchangeGuid missmatch, expected '{0}', found '{1}'. (also ArchiveGuid) | Target GUID differs from the source | Wrong value stamped on the target mail user | Copy the source mailbox's GUIDs, rerun mapping |
Missing required EmailAddresses. Expected '{0}', found '{1}'. | The target lacks the source address | Incomplete target mail user | Add the source user's address |
'{0}' email addresses use domains that are not accepted in the organization. | Foreign domains on the target | Only source or target domains are allowed | Remove them, or accept the domain |
Couldn't find a mail user with '{0}' ExternalEmailAddress in '{1}' tenant. | No matching target | ExternalEmailAddress isn't the source user's address | Set ExternalEmailAddress |
The mail user '{0}' is synchronized from an on-premises directory. | Synced (hybrid) target | Standard mapping can't write to it | Microsoft's hybrid tenant steps |
API responses#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
HTTP 409 Conflict | The job must be in a final state (completed, failed or canceled) before deletion | Job still running | Cancel or wait, then delete |
HTTP 422 BadArgument | duplicateDisplayNameJob or minThresholdFailed | Reused batch name, or completeAfterDateTime in the past | A unique name; a future time |
How to verify a fix#
Test the endpoint before you restart anything. A good result reports Result : Success:
PowerShell
Test-MigrationServerAvailability -IMAP -RemoteServer imap.contoso.com -Port 993
Test-MigrationServerAvailability -ExchangeOutlookAnywhere -ExchangeServer exch01.contoso.local `
-RPCProxyServer mail.contoso.com -Authentication Basic -EmailAddress admin@contoso.com -Credentials (Get-Credential)
Test-MigrationServerAvailability -Gmail -EmailAddress admin@fabrikam.com `
-ServiceAccountKeyFileData ([System.IO.File]::ReadAllBytes("C:\keys\gws.json"))
Test-MigrationServerAvailability -Endpoint "T2T-Fabrikam" -TestMailbox user@contoso.com # cross-tenant, in the target- Resume the fixed user (Resume migration in the EAC, or
Start-MigrationUser) and confirm it moves to Synced with an empty ErrorSummary. - For cross-tenant moves, rerun identity mapping and confirm the user passes validation in the next batch.
- After completion, compare item counts with
Get-EXOMailboxStatisticsbefore you remove the source.
References#
- Troubleshooting issues with IMAP mailbox migration and Can't migrate IMAP mailboxes from Exchange Server 2010 (Microsoft Learn)
- We weren't able to connect to the remote server error and Not a valid SMTP address in a cutover migration (Microsoft Learn)
- Error during mailbox migration from Google Workspace and Migrate mail from Google Workspace (manual method) (Microsoft Learn)
- Resolve errors during orchestrated migration and Cross-tenant mailbox migration (Microsoft Learn)
