How to Migrate from Amazon WorkMail to Microsoft 365

Amazon WorkMail ends on March 31, 2027. WorkMail was built to feel like Exchange, so a lot of teams that used it with Outlook will land on Microsoft 365. Here's how to move.

The tool is Microsoft's IMAP migration. It's built into Exchange Online and it works with WorkMail, but IMAP carries email only. Calendars and contacts are a separate step, covered below.

1. Set up Microsoft 365 without touching mail yet

Add your domain to Microsoft 365 and verify it with the TXT record it gives you. Don't change your MX records yet; mail keeps flowing to WorkMail. Create a user with an Exchange Online license for every WorkMail user, using the same addresses. Recreate WorkMail groups as distribution lists or Microsoft 365 groups. If you haven't listed your groups and aliases yet, the exit checklist covers that.

2. Gather what Microsoft needs to reach WorkMail

• The IMAP server for your Region: imap.mail.us-east-1.awsapps.com (N. Virginia), imap.mail.us-west-2.awsapps.com (Oregon) or imap.mail.eu-west-1.awsapps.com (Ireland). Port 993, SSL.
• Each user's WorkMail login and password. Microsoft recommends resetting passwords for the migration rather than asking users for theirs. Reset them to temporary passwords in the WorkMail console.

Before you build anything, check that Exchange Online can reach WorkMail. In Exchange Online PowerShell:

Test-MigrationServerAvailability -IMAP -RemoteServer imap.mail.us-east-1.awsapps.com -Port 993 -Security Ssl

3. Build the CSV

The migration batch reads a CSV with exactly these three column headers, spelled this way, with no spaces:

EmailAddress,UserName,Password
sam@example.com,sam@example.com,Temp-Pass-1
jo@example.com,jo@example.com,Temp-Pass-2

EmailAddress is the Microsoft 365 mailbox. UserName is the WorkMail login, which is the user's email address. A file can hold up to 50,000 rows, but smaller batches are easier to watch and retry. Treat the file like the passwords it contains, and delete it when you're done.

4. Run the migration batch

In the Exchange admin center, go to Migration, add a migration batch to Exchange Online, and choose IMAP migration. Create an IMAP endpoint with the server, port 993 and SSL from step 2, upload the CSV, and start the batch.

The batch does a first full copy. After that it keeps syncing new mail from WorkMail on a schedule until you mark it complete. That lets you migrate first and switch MX afterward:

1. Wait for the first sync to finish for everyone.
2. Change your MX record to the value Microsoft 365 shows for your domain. New mail starts arriving in Exchange Online.
3. Give it a day for DNS to settle and the batch to sync whatever reached WorkMail in the meantime, then complete the batch.

5. Fix sending: SPF and DKIM

WorkMail sent through Amazon SES, so your SPF record probably includes amazonses.com. Add Microsoft's (include:spf.protection.outlook.com), turn on DKIM for your domain in Microsoft 365, and remove the SES entry once nothing else sends through it. The SPF, DKIM and DMARC explainer covers the why.

6. Move calendars and contacts

If your users run classic Outlook for Windows against WorkMail, this part is easy: export a .pst from the WorkMail account (File → Open & Export → Import/Export) and import it into the new Microsoft 365 account. Apple users can export an .ics per calendar and a vCard of contacts instead; the export guide shows how.

7. Archive, then delete WorkMail

Run a final mailbox export to S3 for your records once mail has stopped arriving in WorkMail. Keep the organization a week or two as a safety net, then delete it.

Is Microsoft 365 the right landing spot?

If your team lives in Outlook and Office, it's the natural home. If you chose WorkMail to keep email inside your own AWS account, inbox.camp does that. Still deciding? Here's every alternative, compared.