Workspace Migrator

Add a tenant

Add one destination and every source tenant you are merging into it.

Allow API access (once per tenant)

Google Cloud console: enable Admin SDK, Gmail, Google Drive, Google Calendar, People, Google Tasks, Groups Settings, Enterprise License Manager and Cloud Identity APIs.
Create a service account, download its JSON key.
That tenant's Admin console → Security → Access and data control → API controls → Domain-wide delegation: add the client ID (shown on the tenant card) with these scopes:

Source tenants

Destination tenant

Optional scopes (group settings, licences, policy report) can be left out; their checks show amber.

Tenants

Address rewriting

Used for sharing, attendees and group members that point at other migrated people. Filled in on verification.

Source domain	Rewrite to

Reset

Nothing in any Google tenant is changed by a reset. Your sign-in token, 2FA and the audit trail always stay.

Clear dashboard & logs recommended
Deletes all jobs, logs, progress and speed history so the dashboard starts from zero. Tenants, users, mapping and domains stay. The record of what was already migrated is kept, so the next run never copies anything twice. Clear dashboard & logs, and forget what was migrated
Same as above, and the next run re-checks every item from scratch. Drive, calendar, contacts and tasks are still matched against the destination, so nothing is copied twice. Email is too, only if the destination has the optional gmail.metadata scope. Archive everything and start a new project
Saves a complete archive of this project, then removes tenants, users and jobs so you can migrate the next company.

Bring all domains into the destination

Migrate first. While a domain still lives in its source tenant, its users land on a temporary address (for example john.acme@newco.com). People keep working in the source meanwhile.
Move the domain. Google allows a domain in one tenant only: remove it from the source tenant (Admin console → Account → Domains), then click Add to destination and verify it with the DNS TXT record Google shows.
Delta sync (Migrate tab → Δ Delta sync): only mail, files, events, contacts and tasks created or changed since the last run move; edited files are refreshed.
Cut over. Every account and group is renamed to its original address; the temporary address stays as an alias.

Domains

Domain	Source tenant	In destination	Users	On original address
Loading…

Conflicts only Export CSV Import CSV

	Source	Batch	Destination account (type or pick)	Destination OU

Destination accounts

Accounts that already exist in the destination tenant. Pick one in a user's row to merge into it.

Account	Name	OU	Receives data from
Verify the destination tenant to load its accounts.

Check readiness before starting.

Job

Tenant	Source	Data	Status	Progress	Found	Migrated	Already there	Failed	Data	Speed

Live log

Warnings & errors only

Not 100% only Export CSV

Tenant	Source	Destination	Data	Status	Complete	Found	Migrated	Already there	Failed	Remaining	Data

Export CSV

When	Scope	Kind	Source id	Destination id	Status	Error

Every failure with its reason. Retrying re-runs only these users; successful items are never moved twice.

When	User / scope	Kind	Item	Reason

Google's Policy API can read Admin-console settings but can write almost none of them, so settings are compared, not copied. Tick Policy report on the Migrate tab to refresh the snapshot.

Tenant	Source OU	Destination OU	Setting	Status	Source value	Destination value

Security checks

Protection layers

Loopback-only by default; optional IP allowlist; Host allowlist blocks DNS rebinding.
Access token stored as a scrypt hash; optional TOTP second factor; lockout after 5 failures.
Server-side sessions bound to this browser, 30-minute idle timeout, HttpOnly + SameSite=Strict cookies.
CSRF token and Origin check on every change; strict Content-Security-Policy; no framing.
Service-account keys, temporary passwords and the 2FA secret encrypted at rest (AES + HMAC).
Drive files spool through AES-256 encrypted, anonymous temp files; nothing readable stays on disk.
All Google traffic is TLS; source access is read-only except a temporary Drive share that is removed at once.
Tokens and keys are scrubbed from logs; every admin action goes into a hash-chained audit trail.

Audit trail

When	Who	Action	Detail

Tenants, step by step

Everything, by state

Progress by data type

Progress by domain

Automatic batches

Speed: items per minute

Data rate: MB per minute

Time to finish