Choose SharePoint Online site by site, with every blocker answered

Chapter 4 recommended a destination for the estate on the constraints Chapter 3 weighed. When it is SharePoint Online, each site is tested again, because a copy moves one site at a time and leaves the farm behind: the code on its servers, the engines behind its workflows and forms, its integrations, its index, its addresses. Part III decided each of those; this chapter reads the answers site by site, and adds three questions: will the tenant recognise the people in the content, can a documented route carry it, and who runs a service you no longer patch?

What has to be true about a site before it can live in SharePoint Online, and is it true for this one?

The decision this chapter leads to is a destination for every site collection: SharePoint Online when each of its blockers has a recorded answer, and otherwise Subscription Edition (Chapter 23) or one of Chapter 26's dispositions, with the blocker that decided it written beside the site.

Which sites this chapter is for

Every site collection on a SharePoint Server 2016 or 2019 farm that the recommendation sends online, to be copied, verified and cut over as Chapters 8 and 9 set out. Whether anybody uses it is Chapter 14's question.

What does not cross, and where it is decided

Sources for the table: farm solutions, add-in retirement, workflows, SPMT FAQ, BCS retirement, Secure Store, cross-site publishing, limits, SPMT permissions, user mapping file and custom script, all checked on 6 November 2026.

Each row is decided in its own chapter and read here per site: mark the rows each site collection uses, from the inventory of Chapter 2 and the readings of Chapter 15. A row is answered when its chapter's disposition exists for this site: rebuilt and tested, replaced, retired with its owner's agreement, or accepted as lost in writing. "We will rebuild it" is not an answer. It is the plan to find one.

Who the content will recognise

Online, your people sign in through Microsoft Entra ID, which Microsoft 365 uses "to manage identities and authentication" (identity models, checked on 6 November 2026). The farm's permissions name its own accounts and groups, and to keep them "there must be a corresponding user in SharePoint", most easily by synchronising Active Directory to Entra ID; with no mapping, files take "the default permission of the location" (SPMT permissions, above). Every account with access to the site has to arrive synchronised, or be replaced on purpose.

Microsoft's migration tool, SPMT, maps users to Entra ID "where possible", or from a file that pairs each login name or SID with a user principal name and flags Active Directory groups; with that file and automatic mapping off, it looks up nobody missing from the file (SPMT settings, user mapping file, both checked on 6 November 2026). It writes a UserNotMapped.csv report (release notes, checked on 6 November 2026), and we would accept a site only when each row has a decision. It "only migrates default SharePoint groups" (user mapping file, above): a site that grants access through groups of its own needs them recreated, or a route that carries them, and we would compare effective access on a copy, as Chapter 8 does.

We would keep the bar Microsoft set for identity mapping in SMAT, the assessment tool whose support ended on 1 October 2026 (SMAT): "synchronize 100% of the identities that have access to the source SharePoint environment", with a reason for each one left out (identity mapping, both checked on 6 November 2026). The profile properties SharePoint Online synchronises "aren't configurable" (profile synchronisation, checked on 6 November 2026), so a site that reads a custom one needs another source.

The routes Microsoft documents

Three Microsoft routes write into SharePoint Online, and one of them reads a farm.

• The SharePoint Migration Tool (SPMT), free, reads SharePoint Server 2010, 2013, 2016 and 2019, SharePoint Foundation 2010 and 2013, and file shares (SPMT overview). It migrates "Out-of-the-box" sites "that don't use any coding or third-party tools" (what SPMT supports, both checked on 6 November 2026), and cannot use Windows authentication against a web application that also offers another method (SPMT overview). Microsoft now sends SharePoint Server scans to it (SMAT, above).
• Migration Manager moves file shares and cloud sources such as Google, Dropbox and Box, and "doesn't support the migration of content from SharePoint Server" (Migration Manager FAQ, checked on 6 November 2026).
• The Migration API imports packages "from file shares, SharePoint Server, and other cloud-based services", "on a best-effort basis", with no SLA, and Microsoft's guidance to migration vendors starts with it (Migration API, ISV guidance, both checked on 6 November 2026).

On SPMT's status, its release notes list build 4.1.130.4 as current (release notes, above), and we found no Microsoft page announcing an end for it. Microsoft's landing page still says "SharePoint Server 2010, 2013, and 2016 environments only" (migrate to Microsoft 365, checked on 6 November 2026) while the tool's own pages include 2019, and none of them names Subscription Edition: we do not know whether SPMT reads one. A site that needs something no route carries has a blocker, whatever the tool.

What Microsoft runs, and what stays yours

SharePoint Online has no farm for you to patch: "Microsoft handles all the management of SharePoint Online" (farm solutions, above), and a SaaS customer still owns its data, identities and configuration (shared responsibility, checked on 6 November 2026). Microsoft 365 follows the Modern Lifecycle Policy, under which customers "stay current as per the servicing and system requirements" (Modern Lifecycle Policy), and what you keep current is what connects: an on-premises Office version outside mainstream support is not a supported connection (Office lifecycle FAQ, both checked on 6 November 2026).

Microsoft 365 "delivers updates continuously" (release options) and announces them in the Message centre, major updates "at least 30 days in advance when an action is required" (Message center, both checked on 6 November 2026). Release audiences control "when" users receive a change (change guide, checked on 6 November 2026): Standard release is the default, Deferred release holds eligible major updates for "approximately 30 days" outside government clouds, and Targeted release enrolment freezes in November 2026 before the option retires in January 2027 (release options, above). None of the documented options declines a change. What stays configurable is the tenant's: sharing and default links, access from unmanaged devices or other networks, site creation, storage and version limits (organisation settings, checked on 6 November 2026).

On a farm you decided when it changed. Online, you decide who reads the notice. We would name an owner for SharePoint posts in the Message centre before the first site moves, and keep a test for every customisation a site keeps, for the day a post says its ground has moved.

Boundaries that are not numbers

The numbers are on Microsoft's limits page (above), which also caps a site at 25 TB; Chapters 12 and 13 measured the ones that decide structure and permissions. Three boundaries are not numbers:

• Retirements apply to every tenant. A retired Business Connectivity Services "can't be re-enabled" (BCS retirement, above), and an app catalogue "does not provide a way" to keep add-ins running (add-in retirement, above).
• Script belongs to the tenant. Custom script is blocked on most new sites and allowed on one for "a maximum of 24 hours"; while it is blocked, owners cannot add Script Editor or Content Editor web parts or create master pages (custom script, above), and some web parts migrate only while script is allowed (SPMT settings, above). What a script web part already on a page does after the reset, we do not know: a classic site built on them is tested on a copy, or modernised first (Chapter 28). The allowance itself ends on dates Microsoft has set, which Chapter 28 gives.
• The service protects itself. An application over its limits is throttled and may be blocked, and "Load testing isn't allowed on SharePoint Online" (throttling, checked on 6 November 2026), so each integration proves its real job at its real volume, as Chapter 22 asks.

SharePoint Online, Subscription Edition or Chapter 26

A site goes to SharePoint Online when four things are recorded for it: every row it uses has its chapter's answer; every identity with access maps, or has a reason not to; a documented route carries it, with what the route leaves behind listed; and its owner accepts a service that changes on Microsoft's calendar.

A site that fails one goes where the failure points. Code, add-ins or 2013 workflows that must run as they are point to Subscription Edition, where Chapters 15, 17, 18 and 19 can keep them; a site nobody needs, or one kept only for an obligation, points to Chapter 26. A blocker with a funded fix and a date keeps the site on the online list for a later wave, recorded as Chapter 4 records every elimination: the fact, the cost of removing it, the date.

Out of scope

Choosing a route is Chapter 29, hybrid Chapter 25, archiving first Chapter 27 and modernising first Chapter 28. The directory and its synchronisation are not designed here, and the rules the tenant enforces belong to Chapter 6. Designing hubs, the home site and menus for the sites that arrive is a separate decision. Adoption, training, Teams governance and licensing are not covered.

Before you continue

• Every site collection bound for SharePoint Online has its rows of the table marked, from the inventory
• Every marked row has its chapter's disposition for this site, and none is only a promise to rebuild
• Every person and group with access maps to an Entra ID identity or has a recorded reason, and each row of the unmapped users report has a decision
• Access through the site's own SharePoint groups is recreated or carried, and effective access was compared on a copy
• Each site has a documented route, and what it does not carry is listed against the site
• A named owner reads SharePoint posts in the Message centre, and the release option is chosen before the first site moves
• Each site's destination is recorded (SharePoint Online, Subscription Edition or a Chapter 26 disposition) with the blocker that decided it

Download chapter 24 (PDF)Same text, same tables, same sources as this page.