“Zero data loss” is easy to put on a slide and hard to engineer. On multi-domain government and enterprise migrations — fifteen thousand-plus mailboxes in our track record — the phrase only means something when it is backed by architecture: content inventory as contract, delta-sync cutovers, verification tooling, and chain-of-custody reporting someone will sign.
Inventory as contract
Before tools run, agree:
- What objects are in scope (mailboxes, shared, sites, file shares)
- What “complete” means (item counts, bytes, folders, permissions?)
- Who signs acceptance per wave
- What is explicitly out of scope (PST graveyards, personal drives)
Without that, every missing folder is a breach of an unspoken promise.
Architecture patterns that protect data
- Pre-stage + delta so cutover is not a bulk copy under time pressure
- Idempotent remigration of failed items with logs
- Hold source read-only after cutover until acceptance
- No silent filter of “old” items without business sign-off
- Clock skew and timezone awareness for date filters
Verification
Trust but verify:
- Sample item hash or count reconciliation per wave
- User UAT checklists for critical mailboxes
- Spot-check search for known messages
- Permission samples on SharePoint/OneDrive when in scope
Government clients often need written chain-of-custody: who ran which job, when, with which credentials, and what the logs said. Build reporting into the factory, not as an afterthought.
Multi-domain complexity
Multiple SMTP domains, dual delivery, and legal entities multiply edge cases. Map domains to tenants carefully; do not orphan an alias domain mid-wave. Identity collisions (two jsmiths) are data-quality issues that become data-loss tickets when the wrong mailbox gets the mail.
What zero data loss does not mean
- Eternal dual-write
- Infinite PST recovery of junk never in scope
- Perfect Teams chat history in every tool generation
- No user-perceived downtime ever
Be precise in the SOW.
Extended practice notes (2021)
The remaining gap between a short checklist and a usable field note is usually scenario detail. In practice, the same engagement type described above still requires explicit answers to: what is in scope this quarter, what is deferred with a date, who can halt a wave, and how success is measured in production — not in a lab.
We document those answers before the first production change. When stakeholders disagree, the disagreement is resolved in writing, not on the bridge at cutover. That habit is independent of whether the workload is mail, identity, virtualization, desktop delivery, or security hardening.
Repeatable detail also includes communication: who tells users what changes, when the freeze starts, where status is posted, and how exceptions are requested. Technical excellence without communication still produces an outage from the user's point of view.
If you're facing this
If a RFP demands zero data loss without defining scope and verification, force the definition before bid. We design migration architectures with acceptance criteria governments and enterprises can audit — bring domain lists and what “done” must mean in writing.