Nine Days to Mail Cutover, a Union Notice, and an Untested Rollback
Corvus Manufacturing (2,400 users) is nine days from cutting email over from on-premises Exchange to Microsoft 365. The 120-user pilot had six failed mailbox migrations, all involving large archives, each resolved by hand. A network assessment shows the Monterrey plant has about 250 kbps per user available, against the migration team's stated 600 kbps requirement for the cutover weekend. The rollback plan is recorded as 'restore from backup'; the backup is 30 TB, taken nightly, and has never been restore-timed. The executive sponsor has told the board that the data center lease, which ends in 45 days, will not be renewed. The change advisory board meets in three days. A union agreement requires 14 days' written notice before any change affecting shift workers' email.
1. What is your go/no-go recommendation, and on what criteria?
Read the worked answer
No-go for a single all-user cutover in nine days. Three facts drive it.
Migration failures: six of 120 (5%) failed on large archives and each needed manual handling. At 2,400 users that projects to roughly 120 failures - survivable only if the cause is fixed and staff are rostered, neither of which is established.
Monterrey bandwidth: 250 kbps available against a 600 kbps requirement. Small items may work, but a cutover weekend implies bulk migration and OST backfill; at that rate the site will not finish in the window and users arrive Monday with half-synced mailboxes. Either remediate the link or exclude Monterrey from wave 1 with cached mode.
Rollback: untested, so the risk is unquantified.
Counter-proposal: wave 1 = pilot plus two well-connected sites (~600 users) on the planned date if the archive failure cause is fixed and a timed restore has been demonstrated. Monterrey deferred until the link is upgraded or a local seeding plan is tested. Full cutover gated on wave-1 exit criteria. Take that to the CAB as a written paper, not a verbal update.
2. Critique the rollback plan and design one that would satisfy a change advisory board.
Read the worked answer
'Restore from backup' is not a rollback plan. It names a mechanism with no scope, no time, no trigger and no test - and 30 TB has never been restore-timed, so its duration is unknown. A rollback you cannot finish inside the business tolerance is not a rollback.
What a CAB needs:
- Target: a stated RTO, for example mail flowing again within four hours of the decision, with no loss of messages sent during the cutover.
- Mechanism: co-existence. Keep Exchange running with mail routing between systems during the wave, and roll back by switching MX and routing rather than by moving mailboxes.
- Triggers agreed in advance: e.g. more than 15% of a wave unable to access mail by 10:00 Monday, or authentication failure across a whole site.
- Authority and deadline: a named decision-maker, deciding no later than a stated time on cutover Sunday.
- Evidence: a timed restore of a 2 TB subset before the CAB, and a lab-proven MX switchback.
Co-existence is what makes rollback cheap. A full switchover leaves only the backup, which is the weakest option available.
3. How do you handle the sponsor's board commitment and the union notice requirement?
Read the worked answer
Two separate problems: expectations upward, contractual notice sideways.
Upward: the sponsor has made a public commitment the plan cannot meet. Give them a one-page options paper - dates, the Monterrey constraint, the untested rollback, the projected failure rate - and ask for a decision between phased delivery and a delayed full cutover. Do not let the CAB be the first place the sponsor hears it. Also separate the deadlines: the lease ends in 45 days and email is only one workload in that data center. Ask what else depends on it and whether email is genuinely on the critical path. A property deadline is not a reason to run an untested cutover.
Sideways: the union requires 14 days' written notice before changes affecting shift workers' email; nine days is inside that. Either serve notice now and move the affected wave past day 14, or exclude shift workers from wave 1 entirely. Get it right - a procedural breach invites a grievance and undermines the change itself.
Record both threads in the CAB pack: the decision taken, the risk accepted, by whom and when.