You have a mailbox to move from Microsoft 365 to a new IMAP host. The obvious tool for the job is IMAPSync — it has moved millions of mailboxes and it is the first thing most administrators reach for. So you install it, set your source server to outlook.office365.com on port 993, run it, and it fails to authenticate.
The good news is that nothing is broken and nothing is lost. IMAPSync works fine. The mailbox is fine. What has changed is how Microsoft expects a client to authenticate, and depending on how your Microsoft 365 subscription was sold to you, using IMAP may not be something you can easily do.
This article covers the manual path: exporting the mailbox to a PST file and uploading it to your IMAP server through Outlook. It is slower than a sync tool and it requires classic Outlook on Windows, but it is reliable, it costs nothing, and it works when the automated route is closed to you. For one mailbox, or a handful, it is often the fastest route.
We will also be clear about when you should not use this method, because for some readers there is a better answer.
Why IMAPSync Fails on Microsoft 365 Accounts
Microsoft did not turn off IMAP, but it did change how IMAP authentications are handled.
Exchange Online spent several years phasing out Basic Authentication — the ordinary username-and-password exchange that IMAP clients have used since the protocol was written. That process finished for IMAP, POP3, EWS and ActiveSync at the end of 2022. The IMAP protocol itself is still there, still supported, still serving mail. What it no longer accepts is a plain password.
The modern replacement is OAuth 2.0, and IMAPSync supports it. This is the part that surprises people who assumed the tool had simply stopped working. It hasn’t. But using OAuth in Microsoft 365 means registering an application in Microsoft Entra ID, granting it the appropriate API permission for IMAP access, and generating tokens for the tool to present. That is a tenant-level administrative operation.
And this is where a lot of migrations stop. Common reasons the OAuth route is unavailable in practice:
- No Entra administrative access. Microsoft 365 is frequently sold through hosting resellers and domain registrars. The person who owns the mailbox may hold a control panel login that manages billing and users but exposes nothing resembling app registration.
- Tenant policies block legacy protocols outright. Conditional Access rules that block legacy authentication are common and sensible security practice, and they can catch migration connections in the crossfire.
- The mailbox is already deprovisioned or in a grace period. Subscription lapsed, mailbox in soft-delete — the data may still be retrievable through a support request even when live protocol access is gone.
- The source never offered IMAP at all. Some hosted Exchange configurations simply do not expose it.
These are the usual causes, not an exhaustive list. Authentication failures are generally specific to a tenant and if the failure occurs for one account, expect the same on the others.
Before you go any further, there’s an important decision to make.
If you have genuine administrative access to the Entra tenant, and you are moving more than two or three mailboxes, stop reading here and configure IMAPSync with OAuth instead. Microsoft documents the process, IMAPSync’s own documentation covers the token generation, and a properly configured sync will move dozens of mailboxes unattended while you do something else. The manual method below does not scale, and doing it twenty times would be a miserable way to spend a week.
The rest of this article is for everyone else.
Choosing Your Path
| Method | Best for | Requires | Cost |
|---|---|---|---|
| Manual PST export and upload | 1–3 mailboxes | Classic Outlook on Windows; time | Free |
| IMAPSync with OAuth | Any volume | Entra admin access; command line comfort | Free |
| Commercial PST-to-IMAP utility | Many mailboxes, no admin access | Windows; a licence | Paid |
Several commercial utilities read PST files and upload directly to an IMAP server, bypassing Outlook entirely. Search for “PST to IMAP” tools if you are in the third row. We have not tested these and do not recommend a specific product — but if you are evaluating them, insist on a trial that processes a real mailbox before you pay, confirm the tool preserves original message dates rather than stamping everything with the upload time, and be skeptical of any product claiming it can move contacts or calendars to an IMAP account. More on that below.
Step 1: Export the Mailbox to PST
If you can still open the mailbox in Outlook, you can export it yourself: File → Open & Export → Import/Export → Export to a file → Outlook Data File (.pst). Select the mailbox at the top of the tree and include subfolders.
If you cannot reach the mailbox — expired subscription, lost credentials, deprovisioned account — the provider’s support team can usually produce the export for you. It is a routine request and worth making before the retention window closes.
Two things to get right at this stage.
Use classic Outlook. The newer Outlook for Windows cannot open or create PST files and cannot manage profiles. If the application shows a “New Outlook” toggle in the top-right corner and it is switched on, switch it off before starting.
Make a second copy of the PST and leave it alone. Put it on a separate drive. This file is the only complete copy of the mailbox once the source is gone, and it is your safety net for every step that follows. Keep it permanently, not just for the duration of the migration.
Step 2: Why You Need a Second Outlook Profile
Here is the constraint that most guides on this topic skip entirely: Outlook will not accept the same email address twice within a single profile. Since you are migrating the same address from one server to another, you cannot simply add the IMAP account alongside the existing one and drag mail across.
You have two options. You can remove the source account from the profile and add the IMAP account in its place — quick, but it burns the bridge before anything has been verified. Or you can create a temporary second profile, do the whole migration there, and leave your working setup untouched until the mail is confirmed on the new server.
The second approach costs a few minutes and is worth it in case something goes wrong in the PST import. Nothing you depend on gets modified until you have proof the copy succeeded.
Close Outlook, then open Control Panel → Mail (Microsoft Outlook) → Show Profiles → Add. Give it a real name rather than something disposable — see the note at the end about promoting this profile instead of rebuilding it. While you are on that screen, select Prompt for a profile to be used, so Outlook asks which profile to open rather than guessing.
Step 3: Connect the IMAP Account
In the new profile, add the destination account using manual or advanced setup and select IMAP. Typical settings:
- Incoming (IMAP): your host’s server name, port 993, SSL/TLS
- Outgoing (SMTP): your host’s server name, port 465, SSL/TLS or STARTTLS
- Username: the full email address
Three settings under More Settings cause most of the trouble on this kind of migration:
Root folder path (Advanced tab). Many hosts expect this set to INBOX. If folders later appear in strange places or fail to show in webmail, this is almost always the reason.
Mail to keep offline (Advanced tab). Set to All.
Sent Items and Deleted Items (their own tabs). Point these at the folders that already exist on the IMAP server. Skip this and you will finish the migration with both a “Sent” and a “Sent Items” folder, split across two years of history.
Send a test message to yourself and confirm it arrives before going further. If your host publishes its settings, check them against the above — this is also a reasonable moment to confirm the destination is a straightforward IMAP email host that supports standard client access without additional hurdles.
Step 4: Copy the Mail to the IMAP Account
Open the PST in the same profile: File → Open & Export → Open Outlook Data File. It appears as a separate tree in the folder list, below the IMAP account.
Now work through it one folder at a time. Resist the urge to select everything and drag it across in a single operation — large transfers time out, and when they do you are left unsure how much actually arrived.
For each folder: create the matching folder under the IMAP account if it does not already exist, open the PST folder, select the messages, then right-click → Move → Copy to Folder and choose the destination. Use Copy, never Move — the PST should remain intact throughout.
For the Inbox and Sent folders, copy into the IMAP account’s existing folders rather than creating duplicates. Old mail will merge with anything already there.
Watch the status bar at the bottom of the window and wait for “All folders are up to date” before starting the next folder. A 5 GB mailbox will typically take a few hours on a decent connection. Very large folders are better split into batches by date, and folders loaded with large attachments are where stalls happen — if a batch hangs, note which messages were involved, move on, and handle them individually afterwards.
Step 5: Verify Before Deleting Anything
Check the destination through webmail in a browser, not through Outlook. Outlook shows you a local cache. That cache can look complete and correct while the server holds far less than you think. Only the server’s own view tells you what’s actually been copied over to the server.
Work through this list:
- Every folder from the PST exists on the server, with subfolders nested correctly
- Item counts match. In Outlook, right-click a folder → Properties gives you the count on the PST side to compare against
- Open the oldest messages, the newest messages, and several with large attachments — confirm the attachments open
- Message dates show the original dates, not today’s date
Do not remove the source account, cancel the old subscription, or delete anything until this checks out.
IMAP Limitations
IMAP is a mail protocol. It moves messages and folders. It does not store contacts, calendars, tasks or notes, and no tool can make it do so — this is a property of the protocol, not a limitation of any particular software. Be wary of products that claim otherwise.
Those items are safe inside the PST, but they need somewhere to live. Two practical options: keep the PST permanently attached to the Outlook profile as a local store, which works but exists only on that one machine, or move to a host that offers server-side contacts and calendars through CalDAV, CardDAV or ActiveSync. If shared calendars or synced contacts across devices matter to the person using this mailbox, that decision is worth making now rather than discovering the gap a week after the old account is gone. Our standard versus groupware comparison covers the difference in more detail.
Server-side rules and mailbox categories will also not survive the move and need recreating.
Finish the Swap and Clean Up
Once verification is complete, restart Outlook and open your original profile. Go to File → Account Settings → Account Settings, select the Microsoft 365 account, and click Remove. This removes it from Outlook only; it does not delete anything from the server. Then add the IMAP account using the same settings as before and let the first sync run.
A shortcut worth knowing: if that original profile contained nothing but the account you just removed, you do not need to rebuild it at all. The temporary profile is already a complete, verified, working setup — just make it the default in Control Panel → Mail and delete the old one. This is why it is worth naming the second profile sensibly when you create it. The one thing you lose by promoting rather than rebuilding is the autocomplete recipient list, which is stored per profile. Signatures live under your Windows user account and survive either way.
Then finish up:
- Delete the redundant profile once you have used the new setup for a few days without issues
- Set the surviving profile as default so Outlook stops prompting
- Keep the PST backup indefinitely — it is your only copy of the contacts and calendar
- Do not cancel the old subscription for at least two weeks
Wrapping Up
Authentication requirements will keep tightening. Microsoft has already signalled that SMTP AUTH with Basic Authentication will be disabled by default for existing tenants at the end of 2026, with a final removal date to be announced during 2027. The pattern is consistent and it is not going to reverse.
What has not changed is the mail itself. It is still just messages and folders, still moveable with standard tools, and still yours. A migration that is initially blocked is usually an access problem, and the PST method outlined here is a viable workaround.
One last thing worth taking from this. When you evaluate a mail host, it never hurts to ask how you would export your mail out of their system should the need arise. Standard IMAP access, no export fees, no support ticket required. It is a question many people don’t want to have to worry about but one that a good host can answer without hesitation.