{"id":93804,"date":"2026-10-24T16:30:16","date_gmt":"2026-10-24T09:30:16","guid":{"rendered":"https:\/\/itsystems.vn\/business-data-migration-preserve-access-permissions\/"},"modified":"2026-10-24T16:30:16","modified_gmt":"2026-10-24T09:30:16","slug":"business-data-migration-preserve-access-permissions","status":"publish","type":"post","link":"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/","title":{"rendered":"Business Data Migration Without Losing Access: Plan, Test and Cut Over"},"content":{"rendered":"<p><strong>Quick answer:<\/strong> To migrate business data without losing or accidentally broadening access, inventory repositories and owners, map source identities and groups to the target, approve the target permission model, pilot with actual role-based accounts, reconcile both files and rights, and only then cut over. Keep the source recoverable until data owners accept the result. Copying files or running a migration tool does not automatically preserve every ACL, sharing link and file-level exception.<\/p>\n<p>This is a <strong>migration-project guide<\/strong>, not a generic monthly backup checklist. Still choosing a target? Compare <a href='https:\/\/itsystems.vn\/en\/nas-file-server-or-sharepoint-for-business\/'>NAS, file server and SharePoint<\/a>. If ownership and role access are unclear, establish a <a href='https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/'>departmental access matrix<\/a> before moving content.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">The content of the article<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Three_failures_that_appear_after_a_rushed_migration\" >Three failures that appear after a rushed migration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Phase_1_inventory_and_classify\" >Phase 1: inventory and classify<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Phase_2_map_identities_and_permissions\" >Phase 2: map identities and permissions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Phase_3_pilot_against_explicit_acceptance_criteria\" >Phase 3: pilot against explicit acceptance criteria<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Phase_4_freeze_delta_and_cutover\" >Phase 4: freeze, delta and cutover<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Phase_5_reconcile_and_decide_whether_to_roll_back\" >Phase 5: reconcile and decide whether to roll back<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Migration_is_not_backup\" >Migration is not backup<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Frequently_asked_questions\" >Frequently asked questions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/itsystems.vn\/en\/business-data-migration-preserve-access-permissions\/#Technical_references\" >Technical references<\/a><\/li><\/ul><\/nav><\/div>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Three_failures_that_appear_after_a_rushed_migration\"><\/span>Three failures that appear after a rushed migration<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Files first, permissions later:<\/strong> the source may contain individual grants, departed users or public links. Preserving everything carries excess access forward; discarding everything stops work.<\/p>\n<p><strong>File count only:<\/strong> bytes may match while documents do not open, metadata or versions are missing, or applications still point at the old path. Reconciliation must test important data and business workflows.<\/p>\n<p><strong>Source retired too early:<\/strong> users keep editing there, the final delta has not finished, or no freeze and rollback exist. Two competing &#8216;master copies&#8217; then become difficult to reconcile.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Phase_1_inventory_and_classify\"><\/span>Phase 1: inventory and classify<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>List shares\/sites, paths, volume, file counts, large files, problematic names, dependent applications, owners, groups and external users. Identify retention obligations and stale or duplicate data, but remove nothing without owner approval. Record the authoritative copy, sensitive areas, write window and recovery requirements.<\/p>\n<p>A useful inventory includes source, proposed destination, owner, read\/edit groups, identity-mapping status, pilot wave and approver. Separate personal drafts from shared business records.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Phase_2_map_identities_and_permissions\"><\/span>Phase 2: map identities and permissions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Map AD, local and guest users to target accounts and approved business groups. Decide inheritance, permitted exceptions, external sharing and service accounts that depend on the old path. Microsoft documents that SharePoint Migration Tool permission outcomes depend on user mapping and permission type; unmapped content can inherit destination defaults. Migration Manager exposes separate file\/folder and delta behavior. Read the behavior of the exact tool\/version, test representative files and validate effective rights with real users.<\/p>\n<p>Technical administrators implement rights; business data owners approve them. Retain a source-permissions export and a signed target matrix as evidence.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Phase_3_pilot_against_explicit_acceptance_criteria\"><\/span>Phase 3: pilot against explicit acceptance criteria<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Choose a common folder, sensitive area, large and awkwardly named files, important versions\/metadata, a read-only user, an editor and a user who must be denied. Move the sample; open it in the real application; check search\/sync where relevant, sharing links and final rights. Classify defects as naming, mapping, permission or application issues before the main wave.<\/p>\n<p>Agree measurable project-specific criteria: which datasets must be complete, how counts and sizes are compared, which errors are tolerable and who decides. Do not promise a generic success percentage without knowing the source.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Phase_4_freeze_delta_and_cutover\"><\/span>Phase 4: freeze, delta and cutover<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Tell users when edits will stop, where the new location is and how to request support. Run the initial migration and a delta where supported. Microsoft&#8217;s Migration Manager documentation warns that permission changes in a delta may only migrate when the corresponding file is transferred; never assume every source-rights change automatically reaches the destination. Retest groups and links after the final wave.<\/p>\n<p>Update applications, shortcuts and mapped drives under a cutover plan. Keep the old source read-only during stabilization if feasible; do not allow two editable masters without designed synchronization and conflict handling. Staff the first support window.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Phase_5_reconcile_and_decide_whether_to_roll_back\"><\/span>Phase 5: reconcile and decide whether to roll back<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Compare each share\/site and critical samples: failed files, counts, sizes, required versions\/metadata, rights for three account types and dependent workflows. Keep migration logs and owner test records. Acceptance requires key users to complete routine tasks and owners to accept any remaining exceptions.<\/p>\n<p>A rollback plan specifies triggers, authoritative-copy timestamp, how destination writes are stopped, how paths and applications revert, the decision maker and maximum recovery window. Once new work exists at the destination, rollback also requires controlled reconciliation of that work.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Migration_is_not_backup\"><\/span>Migration is not backup<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Migration changes the working location; backup provides a recovery path for deletion, corruption or attack. Synchronization may propagate a mistake, and temporarily retaining an old source is not a backup design. After cutover, verify target backup\/restore, retention, version history and backup-copy rights against the approved policy.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Does a file copy preserve every permission?<\/strong> Never assume so; source, target, tooling, settings and identity mapping all matter. Pilot and test actual accounts.<\/p>\n<p><strong>Can staff edit during migration?<\/strong> A delta-supported plan may permit initial work, but a clear freeze\/cutover is still needed to prevent two masters.<\/p>\n<p><strong>Will old SharePoint or file links still work?<\/strong> Test paths and sharing links separately, including application dependencies.<\/p>\n<p><strong>When can the old server be decommissioned?<\/strong> After owner acceptance, tested target recovery, a disposition for open defects and an approved source-retention period.<\/p>\n<aside style='background:#eaf7f6;padding:20px;border-left:4px solid #167d78'><strong>Planning a business data move?<\/strong><\/p>\n<p>IT Systems can work with data owners to inventory repositories, design target rights, run a pilot, reconcile cutover and hand over an operating plan within an agreed project scope.<\/p>\n<p><a href='https:\/\/itsystems.vn\/en\/business-it-system-design-deployment\/#formlead'>Request an IT system assessment<\/a> \u00b7 <a href='tel:02839950359'>Call +84 28 3995 0359<\/a><\/p>\n<\/aside>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Technical_references\"><\/span>Technical references<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"https:\/\/learn.microsoft.com\/sharepointmigration\/understanding-permissions-when-migrating\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: SPMT file and folder permissions<\/a>; <a href=\"https:\/\/learn.microsoft.com\/sharepointmigration\/mm-project-settings-permissions\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: Migration Manager permission settings<\/a>; <a href=\"https:\/\/learn.microsoft.com\/en-us\/sharepointmigration\/mm-settings\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: migration settings and user mapping<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Move business data from a NAS, file server or old cloud repository with an identity map, permission pilot, cutover checks and a rollback plan.<\/p>\n","protected":false},"author":68,"featured_media":93803,"comment_status":"","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_focus_keyword":"business data migration permissions","rank_math_title":"Business Data Migration Without Losing Access: Plan, Test and Cut Over | IT Systems","rank_math_description":"Move business data from a NAS, file server or old cloud repository with an identity map, permission pilot, cutover checks and a rollback plan.","rank_math_robots":"","rank_math_canonical_url":"","rank_math_schema":"","footnotes":""},"categories":[2143],"tags":[],"class_list":["post-93804","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-service"],"wpml_current_locale":"en_US","wpml_translations":{"vi_VN":{"locale":"vi_VN","id":93802,"slug":"di-chuyen-du-lieu-doanh-nghiep-khong-mat-quyen-truy-cap","post_title":"Di chuy\u1ec3n d\u1eef li\u1ec7u doanh nghi\u1ec7p kh\u00f4ng m\u1ea5t quy\u1ec1n truy c\u1eadp: k\u1ebf ho\u1ea1ch v\u00e0 ki\u1ec3m th\u1eed","href":"https:\/\/itsystems.vn\/di-chuyen-du-lieu-doanh-nghiep-khong-mat-quyen-truy-cap\/"}},"_links":{"self":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts\/93804","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/comments?post=93804"}],"version-history":[{"count":0,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts\/93804\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/media\/93803"}],"wp:attachment":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/media?parent=93804"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/categories?post=93804"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/tags?post=93804"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}