Standard Operating Procedure (SOP)

1. Executive Summary & Objective

This operational document defines the complete procedure for migrating Google Workspace data across separate tenants and swapping domain names without password collection or service downtime.

Data Scope: Gmail (RFC822 dates & user labels), Google Drive (full folder hierarchies, binary files & native Google Docs conversion), Google Contacts, and Google Calendar.

2. Roles & Prerequisites

2.1 Passwordless Console Authentication & Roles

The Migration Console uses a pure white enterprise design with passwordless token authentication:

• Sign In: Access via personal Access Token or Magic Link (/?token=...) or registered email lookup.
• Sign Up: Self-service registration generating an instant secure token and direct magic link.
• Administrator Role (2 Focused Options Only): (1) Service Account & DWD (Upload key, copy 21-digit Client ID & scopes, set domains), and (2) Users & Progress (Organization statistics, live migration progress table, operator tokens).
• Operator Role (Interactive 3-Step Wizard): (1) Find all source users, (2) Check & fetch destination accounts, and (3) Select specific services (Mail, Drive, Contacts, Calendar) per user to map and migrate.

3. The 8-Stage Execution Runbook

Stage 1: Connect Service Account & Authorize Domain-Wide Delegation

1. Open the Migration Web Console in your browser.
2. Enter your Old Primary Domain, New Tenant Domain, and Holding Domain, then click Save Domains.
3. Under Connect Google Service Account, upload the Service Account .json key file (or run bash create_service_account.sh).
4. Click Copy Client ID and Copy Scopes.
5. Log into Google Admin Console (admin.google.com) for BOTH tenants:
   • Go to: Security ➔ API Controls ➔ Manage Domain-wide Delegation ➔ Add new.
   • Paste the Client ID and Scopes, then click Authorize.
6. In the Web Console, click Test Connection to confirm green checks.

Stage 2: Pilot Sandbox Test (1 User First)

1. In the green Pilot Test with 1 User First section:
2. Enter Source test user (e.g. pilot@primarydomain.com) and Destination test user (e.g. pilot@justanydomain.com).
3. Click Run Pilot Test.
4. Log into the destination test mailbox to verify data integrity:
   • Gmail: Original received dates and labels preserved.
   • Drive: Folder tree and files accessible.
   • Contacts: Phone numbers, notes, and emails populated.
   • Calendar: Events and recurring meetings populated without invite spam.

Stage 3: Auto-Provision Accounts in Destination Tenant

1. In Phase 1 of the Web Console, click Auto-Provision Users.
2. The system automatically reads all source accounts and creates matching users in the destination tenant with identical display names, given names, family names, and secure temporary passwords.

Stage 4: Execute Full Organization Data Migration

1. In Phase 2 of the Web Console, click Auto-Discover All Users.
2. Click Start Full Migration.
3. The multi-threaded worker pool transfers all accounts concurrently with real-time SQLite checkpointing.
4. If any items pause due to API quotas, click Retry Failures (safely skips already completed items).

Stage 5: Add Temporary Holding Domain to Source Tenant

1. In the Source Tenant Google Admin Console, go to: Account ➔ Domains ➔ Manage domains.
2. Click Add a domain and enter your holding domain (e.g. thirddomain.com) as a Secondary domain.
3. Complete TXT DNS verification to activate it.

Stage 6: Rename Source Users & Strip Aliases

1. In Phase 3 of the Web Console, click Rename Source & Strip Aliases.
2. The system renames all users: user@primarydomain.com ➔ user@thirddomain.com and immediately deletes the alias user@primarydomain.com.

Stage 7: Audit & Delete Primary Domain from Source Tenant

1. In the Web Console, click Verify Release.
2. Confirm that Blocking Users, Aliases, and Groups all equal 0.
3. In Source Google Admin Console, go to Account ➔ Domains ➔ Manage domains, locate primarydomain.com, and click Remove / Delete.

Stage 8: Add Primary Domain to Destination & Final Rename

1. In Destination Google Admin Console, go to: Account ➔ Domains ➔ Manage domains.
2. Click Add a domain and add primarydomain.com as a Secondary domain. Verify DNS.
3. In Phase 3 of the Web Console, click Finalize User Rename.
4. All destination users are switched to user@primarydomain.com. The migration is complete!

4. Sign-Off & Verification Table