# Infrastructure & Identity

A definitive 5-phase guide for engineers to transition email architecture without data loss or downtime.

## 1  Phase 1: Environment Readiness

### Purchase M365 License

Sign up for **Microsoft 365 Business Basic** (or higher). This initializes your global tenant (e.g., `heartbeatai.onmicrosoft.com`).

### Add Your Custom Domain

Navigate to **Settings > Domains > Add Domain** in the Admin Center. Enter your primary domain (e.g., `heartbeat-biz.com`).

**Verification:** Add the TXT record to your DNS (Squarespace/GoDaddy). Crucial: Do not change MX records yet. You are only verifying ownership at this stage.

### Create User Accounts

Go to **Users > Active Users**. Create mailboxes for your team (e.g., `umais@heartbeat-biz.com`) and assign the licenses.

## 2  Phase 2: Source Preparation (Zoho Side)

### Enable IMAP Access

In Zoho Mail: **Settings → Mail Accounts → IMAP**. Ensure IMAP Access is toggled **ON**.

### Handle 2FA & App Passwords

If 2FA is active, regular passwords will fail. Generate a dedicated **App Password** in Zoho Accounts > Security for the migration tool.

### Server Connection Details:

**IMAP Server:** imap.zoho.com  
**Port:** 993  
**Security:** SSL

## 3  Phase 3: The Data Migration

This process copies historical data from Zoho to Microsoft servers without affecting existing mail flow.

### Create Migration CSV

| EmailAddress (New) | UserName (Old) | Password (App Pass) |
| --- | --- | --- |
| umais@heartbeat-biz.com | umais@zoho.com | xxxx-xxxx-xxxx |

### Launch Migration Manager

In M365 Admin: **Setup → Migrations → Email**. Choose IMAP, configure the `imap.zoho.com` endpoint, and upload your CSV.

### Status: Syncing

Users can continue using Zoho. Microsoft will periodically poll and copy new mail until the final cutover.

## 4  Phase 4: The Cutover (DNS Update)

Login to your registrar (Squarespace/GoDaddy) to re-route mail traffic.

**MX Record:** Delete Zoho MX. Add: `yourdomain-com.mail.protection.outlook.com` (Priority 0)

**Autodiscover:** CNAME → `autodiscover.outlook.com`

**SPF:** Update TXT to: `v=spf1 include:spf.protection.outlook.com -all`

**Security:** Enable DKIM and DMARC in the M365 Security Center to prevent spoofing.

## 5  Phase 5: Decommissioning

- **Final Sync:** Run the migration batch one last time to capture "straggler" emails from the DNS propagation window.
- **Stop Batch:** Once all folders (Sent/Archive) match, finalize the batch in M365.
- **Cancel Zoho:** Only terminate the old subscription after verifying data integrity in the new M365 mailboxes.

### Why This Matters for Your AI Bot

By centralizing your identity on Microsoft 365, your `heartbeat-biz.com` email becomes a **Native Microsoft Identity**. When you build with the **Teams Developer Portal**, the Entra ID OAuth handshake is seamless, granting your bot secure, delegated permissions to act on your behalf without technical friction.