SharePoint Server Migration: 15 Gotchas

Why This List Exists

Every SharePoint 2016 and 2019 to SharePoint Online migration we have run or reviewed hits at least three of the following fifteen failure modes. The ones that become project-breaking are always the ones that were not anticipated in assessment.

This article is the failure-mode reference that pairs with the migration checklist and the July 14, 2026 end-of-support pillar decision guide.

Each failure mode below has three parts: what it looks like, why it happens, and what to do about it.

1. Skipping the Pilot Wave

What it looks like: Mid-way through the production-wave schedule, thousands of users hit permission errors, missing search results, or broken workflows. Root cause analysis takes 3 to 5 days per issue while business operations degrade.

Why it happens: Deadline pressure. Teams compress the pilot from 2 to 3 weeks to a single weekend to make room for production waves.

Countermeasure: Protect the pilot as the most important 2 to 3 weeks of the project. Pilot one department with 30 to 100 users, mixed content types, at least one executive, at least one power user, at least one regulated-content scenario. Sign off the pilot formally with executive sponsor approval before proceeding to production waves.

2. Broken Permission Inheritance Carried Forward

What it looks like: Post-migration, users see missing-document tickets for weeks. The IT team chases ghost-permission issues one at a time.

Why it happens: Source farms often have years of broken-inheritance and direct-user grants that migration tools replicate literally. On SharePoint Online, the tangled permission state is even harder to reason about than on-prem.

Countermeasure: Redesign permissions during migration. Map every source permission to an Azure AD security group. Fix broken inheritance in the destination, not the source.

3. Skipping ROT (Redundant, Obsolete, Trivial) Cleanup

What it looks like: Migration takes 30 to 40 percent longer than estimated. Post-migration, the destination tenant has all the same clutter as the source, plus new orphaned sites from the migration process.

Why it happens: Teams treat cleanup as optional or assume they will clean up after migration. Post-migration cleanup almost never happens — the team moves on to the next project.

Countermeasure: Invest 2 to 4 weeks in ROT cleanup before migration. Delete sites with no activity in 24 months (preserving legal holds), remove duplicate files, purge My Sites of ex-employees, and re-run the inventory on a clean baseline before tooling runs.

4. SharePoint Designer 2013 Workflows Not Rebuilt

What it looks like: Post-cutover, every workflow-dependent business process is broken. Document approvals stall. New-hire onboarding halts. Finance approval chains fail.

Why it happens: Teams assume migration tools handle workflows. They do not.

Countermeasure: Inventory every SPD workflow in assessment. Scope workflow remediation as a separate workstream. Rebuild all workflows in Power Automate in parallel with content migration. Validate each rebuilt workflow in the pilot wave before the content it supports migrates.

5. Managed Metadata Term Store Not Pre-Provisioned

What it looks like: Columns with term-store lookups migrate empty or with partial values. The destination term store accumulates duplicate and near-duplicate terms as tools create them on the fly.

Why it happens: Teams rely on migration tools to create terms as needed. Tools create them, but the resulting term store has no governance.

Countermeasure: Export the source term store with GUIDs preserved. Import into the destination tenant before waves start. Validate term GUIDs match between source and destination.

6. InfoPath Forms Not Scoped Separately

What it looks like: Two weeks into the production waves, teams discover that InfoPath forms do not function on SharePoint Online modern sites. Every form dependency has to be replaced on an emergency timeline.

Why it happens: Assessment lumped InfoPath into a generic "we will handle customizations later" bucket.

Countermeasure: Inventory InfoPath forms explicitly in assessment. Each form gets a disposition: retire, rebuild in Power Apps canvas, or rebuild in Power Apps model-driven. Budget 40 to 80 hours per complex form.

7. Search Parity Broken

What it looks like: Users can no longer find the content they searched for daily. Query rules that promoted specific documents vanish. Refiners that grouped documents by department disappear.

Why it happens: Source search configuration does not migrate automatically.

Countermeasure: Export source search configuration as part of assessment. Rebuild query rules, promoted results, and refiners in the destination search service. Plan 1 to 2 weeks of post-migration search-tuning based on user queries and feedback.

8. External Sharing Policy Mismatch

What it looks like: Either external users lose access to content they previously accessed (business disruption), or content suddenly becomes overshared (compliance incident).

Why it happens: SharePoint 2019 and SharePoint Online have fundamentally different sharing models. Defaults differ. Scope differs.

Countermeasure: Audit every external-sharing scope in assessment. Design the destination sharing policy explicitly. Remediate externally-shared content during each wave cutover.

9. Farm Solutions (.WSP) Not Rewritten

What it looks like: Business users discover that a critical custom feature — document classification, approval dashboard, KPI web part — does not exist in the destination.

Why it happens: Farm solutions cannot move to SharePoint Online. Substantial development work is often scoped last.

Countermeasure: Every farm solution in the source gets a disposition decision in assessment: retire, replace with OOB feature, rewrite in SPFx, or rebuild as a Power Platform solution.

10. Large-Item Outliers Missed

What it looks like: Migration waves fail or time out on specific site collections. Post-hoc investigation finds libraries with 100,000+ items per view or individual files over 15 GB.

Why it happens: Assessment averaged item counts across the farm without identifying outliers.

Countermeasure: Flag: libraries over 100,000 items, views over 5,000 items, individual files over 15 GB, site collections over 1 TB. Plan bespoke wave strategies for each outlier.

11. Regulated Content Not Mapped to Sensitivity Labels

What it looks like: Post-migration, HIPAA PHI, PCI cardholder data, and ITAR technical data end up in the destination tenant with no sensitivity labels applied.

Why it happens: Teams treat sensitivity labels as a post-migration activity.

Countermeasure: Design the Microsoft Purview sensitivity-label taxonomy in the target-state architecture. Apply auto-labeling policies in the destination tenant before the first production wave.

12. Hybrid Configuration Not Decommissioned

What it looks like: Post-migration, the source farm is technically running but all content has moved. User-profile sync, OneDrive redirection, hybrid search, and taxonomy replication continue to run.

Why it happens: Decommissioning the hybrid configuration is often out of scope for the migration tooling.

Countermeasure: Include hybrid decommissioning as an explicit workstream. See SharePoint Hybrid to Cloud — The Final Phase of the Hybrid Era.

13. No Hypercare Staffed

What it looks like: The migration team moves on to the next project Monday morning. Users hit issues Tuesday. Tickets pile up.

Why it happens: Hypercare is often the first item cut from the budget.

Countermeasure: Staff dedicated hypercare minimum 4 weeks post-cutover (12 weeks for large enterprise). Dedicated Slack/Teams channel. Named escalation owner. Daily standups in week 1.

14. URL Redirects Not Implemented

What it looks like: Users hit broken bookmarks, broken deep-links in email signatures, broken cross-application links in Teams and Outlook.

Why it happens: Teams focus on DNS and forget about the thousands of in-email and in-document links to old SharePoint URLs.

Countermeasure: Implement URL redirects (IIS-level on the old farm while it still exists, or via an SPFx redirector extension in the destination). Publish a URL migration guide to users.

15. Pre-Migration Content Audit Not Communicated

What it looks like: Users discover during migration waves that content is disappearing — ROT cleanup deletes sites that someone considered important.

Why it happens: The ROT-cleanup workstream ran quietly without stakeholder sign-off.

Countermeasure: Publish the ROT cleanup plan to all content owners before execution. Give every site owner 10 business days to claim content. Archive (rather than delete) anything with an unclear owner. Retain archive for 90 to 180 days post-migration before final deletion.

How These 15 Failure Modes Compound

The reason these failure modes become project-breaking is not any single one — any single issue is recoverable with two or three days of focused work. The reason is that they compound. A typical failing migration hits the pilot-wave skip (failure 1), which masks a permissions-inheritance issue (failure 2), which surfaces mid-production-wave and pulls the team away from customization remediation (failures 4, 6, 9), which gets discovered too late, which pushes cutover past the July 14 deadline, which forces emergency partner engagement at rush rates.

Three or four of these failure modes hitting in sequence will turn a 180-day migration into a 330-day emergency. The single best defense is the pilot wave — it surfaces most of these issues cheaply, two weeks into the project, when there is still time and budget to fix them.

Red-Flag Checklist for Migration Program Health

Run this short checklist every two weeks during the migration. Any "no" answer is a material program risk:

• Has the pilot wave completed with executive sign-off?
• Is the production-wave schedule tracking to the plan (no wave more than one week behind)?
• Are customization remediations (SPFx, Power Automate, Power Apps) tracking on their parallel schedule?
• Are automated post-wave validation scripts running after each wave with results in the SteerCo dashboard?
• Is the destination term store pre-provisioned and governance-owned?
• Is the sensitivity-label architecture deployed to the destination tenant before the first production wave?
• Is hybrid decommissioning scoped as an explicit workstream (for hybrid migrations)?
• Is hypercare funded and staffed for minimum 4 weeks post-cutover?

If three or more answers are "no," the program is at serious risk of missing the July 14, 2026 deadline.

Related Reading

• SharePoint Server 2016 and 2019 End of Support — July 14, 2026 Decision Guide (pillar)
• SharePoint Server 2016 to Online Migration Checklist
• SharePoint Server 2019 Post-EOS Security Risk Assessment
• SharePoint Hybrid to Cloud — The Final Phase of the Hybrid Era

Frequently Asked Questions

What is the single most common reason SharePoint migrations fail?

Skipping the pilot wave under deadline pressure.

How do permission-inheritance breaks cause post-migration issues?

Source farms have broken inheritance with direct user grants. Tools replicate the broken state. Users report missing-document tickets for weeks.

What is wrong with treating ROT content cleanup as optional?

Skipping ROT cleanup inflates migration time by 20 to 40 percent and carries every bad data decision forward.

How do SharePoint Designer 2013 workflows trip up migrations?

SPD workflows cannot migrate. They must be rebuilt in Power Automate with different trigger and approval semantics.

What happens when the destination term store is not pre-provisioned?

Managed-metadata columns fail to populate. Tools auto-create missing terms, producing a fragmented term store with duplicates.

Why do InfoPath forms trip up migration budgets?

Every InfoPath form must be rebuilt in Power Apps. A single complex form takes 40 to 80 hours.

What search-parity issues appear after migration?

Source query rules, promoted results, custom schema, and refiners do not migrate automatically. Plan 1 to 2 weeks of post-migration search tuning.

How do external-sharing differences cause issues?

SharePoint 2019 and SharePoint Online have different sharing models and defaults. Audit all external-sharing scopes and redesign for the destination.