A migration security review, before the data moves and after it lands.
A migration copies every open link, stale token and forgotten OAuth app into the new tenant. Sorami finds them first, then checks the new tenant against ASD baselines.
- OAuth app inventory on both tenants
- External sharing and legacy auth closed, not copied
- Admin roles, MFA and audit logging checked at close
- Mapped to Essential Eight ML2 and ASD Essentials for cloud
Permissions · External sharing · Legacy auth · Tokens · OAuth apps · Admin roles · DMARC · Retention · Audit logging
Sorami reviews the security of a Google Workspace or Microsoft 365 migration in two passes. Before the move we inventory OAuth apps and external shares. We list legacy authentication, service tokens and admin roles so nothing unwanted is copied. After cutover we check the new tenant against Essential Eight Maturity Level 2 and ASD Essentials for cloud.
What security risks does a migration create?
A workplace migration is the largest change most tenants ever see. Every identity is touched, every file is copied and every integration is reconnected. Three things go wrong repeatedly. Open sharing links and over-broad permissions are copied faithfully into the new tenant, where nobody remembers granting them. Legacy authentication and app passwords are left on at the source for a printer or a script, and become the path back in. OAuth applications that had access to mail or Drive are forgotten, still holding tokens against a tenant that is now read-only but not deleted.
The review exists because the migration team is measured on mail arriving and files opening on Monday. Security findings surface weeks later, usually in a penetration test or an incident. Doing the review inside the project is cheaper than doing it after.
What does the pre-migration review check?
- OAuth app inventory: every third-party app with mail, Drive or Graph scopes.
- External sharing: anyone-with-link files and guests, with owner and last access.
- Legacy auth: IMAP, POP, SMTP AUTH and app passwords still in use.
- Service tokens: service accounts, API keys and domain-wide delegation grants.
- Admin roles: super admins and global admins, and who really needs them.
- Mail security: current SPF, DKIM and DMARC state and third-party senders.
- Retention: Vault or Purview rules and holds that must be rebuilt.
- Devices: enrolment coverage and the policies that will not carry over.
Each finding gets a decision before the migration plan is final: recreate on the destination, close at the source, or carry with an expiry. The list of OAuth apps becomes the admin consent allow-list on the new tenant, so staff cannot silently re-grant access on day one.
What does the post-migration review check?
The second pass runs after hypercare, when the dust has settled and the real configuration is visible. We confirm MFA is enforced for every user and legacy authentication is blocked by Conditional Access or Google context-aware access. Admin roles are compared to the pre-migration list and reduced. Sharing policy is set so new external links need approval or expire. DMARC enforcement is restored after the monitoring window. Audit logging is confirmed at the retention your obligations need: Purview Standard keeps 180 days and the Google Admin console keeps six months. Retention rules and holds are checked against the pre-migration inventory.
The source tenant is checked too. Mail flow is stopped, OAuth tokens are revoked, service accounts are deleted and the data is destroyed or exported for retention under APP 11. A tenant that is merely unpaid is still an attack surface.
Which Australian baselines does the review map to?
The post-migration check is written against the Essential Eight Maturity Model at Maturity Level 2: MFA for all users of online services, restricted administrative privileges, patching of the devices that enrol and application control on workstations. ASD published Essentials for cloud on 15 October 2026 for organisations whose technology runs entirely on SaaS and PaaS, and states both frameworks are maintained during a transition period. Where your organisation is SaaS-only we report against both and say which controls differ.
Privacy Act APP 11 is the other anchor. The review confirms the source copy is destroyed or de-identified once the destination is verified, and records where the data now lives. Microsoft stores Australian tenant data in Australia; Google Workspace data regions cover the United States and Europe only. That fact goes into the report whichever direction you moved.
This review is a configuration and permission review, not a penetration test. If a customer or auditor needs offensive testing of the new tenant, the cloud penetration testing service covers Entra ID and Google Cloud identity paths. For infrastructure accounts rather than the office suite, the cloud security review is the matching service. Broader uplift sits with the Essential Eight assessment and the rest of the security practice.
How is the migration security review priced?
Pricing is quoted per user after a 20 minute scoping call. Sorami holds no partner tier with Microsoft or Google and takes no reseller margin, so licences are bought on your account at list price.
The review is quoted as a fixed fee per tenant after the scoping call and can be bought on its own, including for a migration another provider ran. It is the closing step of every Sorami Google Workspace to Microsoft 365 and Microsoft 365 to Google Workspace project, and the external sharing check extends the work on the files and permissions page. The shared method is on the migration services hub.
Practical answers.
Why review OAuth apps during a migration?
Third-party apps granted access to mail or Drive keep their tokens until revoked. A migration is the moment to list them, decide which deserve an equivalent grant on the new tenant and revoke the rest at the source. The list becomes the admin consent allow-list on the destination.
Does the review cover a migration another company ran?
Yes. The post-migration pass works on any tenant. It checks MFA and legacy authentication, admin roles and sharing policy, DMARC enforcement and audit retention. It also checks the state of the old tenant. Findings come with an owner and an effort estimate.
Is this a penetration test?
No. It is a configuration and permission review of both tenants. Offensive testing of identity paths is a separate service, cloud penetration testing, and a customer or auditor asking for a pentest should be given that scope instead.
Which framework do you report against?
Essential Eight Maturity Level 2 and, for SaaS-only organisations, ASD Essentials for cloud published on 15 October 2026. The report names which controls differ between the two. Privacy Act APP 11 covers destruction of the source copy.
What happens to the old tenant?
Mail flow is stopped, OAuth tokens and service accounts are revoked, and data is destroyed or exported for retention. The review signs that off in writing. An old tenant left unpaid but intact is still an attack surface.
Migrating, or just migrated?
Send which direction you moved and when. We reply within one business day with a scoping call time for the review.
Last reviewed: