How to Migrate Lotus Notes (HCL Domino NSF) to Microsoft 365 / Office 365

How to Migrate Lotus Notes (HCL Domino NSF) to Microsoft 365 / Office 365

Migrating an enterprise from IBM or HCL Lotus Notes to Microsoft 365 is easily one of the most punishing cutovers in enterprise messaging.

Lotus Notes doesn't behave like standard email systems. It doesn't use RFC-822 text streams. It doesn't use relational SQL tables. Instead, it locks everything inside proprietary Notes Storage Facility (.nsf) document databases. We're talking about rich text blocks, embedded OLE items, custom Domino DocLinks (notes://), local database ACLs, and user encryption keys (user.id).

Try pushing NSF mailboxes through basic IMAP relays or generic CSV scripts, and things fall apart fast. DocLinks break. Tables scramble. Recurring calendar appointments offset by daylight savings hours, leaving users furious.

Here's our production-tested engineering playbook: resolving Lotus Notes database locks, translating Domino Canonical addresses (CN=John Doe/OU=Sales/O=Corp) into Microsoft Entra ID UPNs, and moving your archives to Microsoft 365 without dropping a single email.

>

* 🔍 Run Free NSF / PST Structure & Header Diagnostic ➔

* 🚀 Download Standalone Lotus Notes NSF to Microsoft 365 Migration Engine ➔

* 📊 Estimate Cloud Network Ingestion & Data Bandwidth Timelines ➔

Architectural Comparison: HCL Domino (NSF) vs Microsoft 365 (Exchange Online)

Why do Domino-to-Exchange cutovers cause so much friction? It comes down to two completely different storage philosophies.

Locating & Preparing Your Lotus Notes NSF Files

Before moving any data, you've got to gather the user mail databases and verify that access control lists (ACLs) aren't locked.

Where Lotus Notes Keeps Your Mail Data

On client workstations, Lotus Notes stores local replicas and personal address books in the Data directory:

• Windows 64-Bit: C:\Program Files (x86)\HCL\Notes\Data\ or C:\Users\\AppData\Local\HCL\Notes\Data\
• Domino Server: /local/notesdata/mail/ or D:\Domino\Data\mail\

Make sure you collect these essential files:

• username.nsf — The primary user mailbox database.
• names.nsf — The personal address book holding contacts and distribution groups.
• archive\a_username.nsf — Local offline archive databases.
• user.id — The cryptographic key required to unlock user-level encrypted messages.

Unlocking Local NSF Database Encryption

If local databases were created with "Enforce Consistent ACL" or local encryption, external tools can't read them:

1. Open the HCL Notes client as the target user.
2. Go to File > Database > Properties (or Application > Properties).
3. Click the Encryption Settings button on the database tab.
4. Select "Do not locally encrypt this database" and hit OK.
5. Run database compaction (File > Database > Compact) to rewrite unencrypted pages to disk.

Approach 1: The Domino Server IMAP Connector (Best for Basic Mailboxes)

If your team still runs an active IBM/HCL Domino Server and you only need plain email text without complex DocLinks or embedded graphics, you can turn on the Domino IMAP task.

Configuring the IMAP Task on Domino

1. Open the Domino Administrator client.
2. In the Server Configuration document, browse to MIME > Conversion Options.
3. Enable the IMAP Service on Port 993 with SSL enabled.
4. In the Domino Server console, run the maintenance tasks to create IMAP indexes:

   load convert -e mail/username.nsf
   load convert -h mail/username.nsf

Syncing Mail via Exchange Online Migration Dashboard

1. Open the Exchange admin center (https://admin.exchange.microsoft.com).
2. Head to Migration > Batches > Add migration batch.
3. Choose IMAP migration as the batch type.
4. Enter your Domino Server endpoint (mail.yourdomain.com), Port 993, and SSL security.
5. Upload a CSV file matching Domino mail accounts to Microsoft 365 user mailboxes.

⚠️ Why Approach 1 Falls Short for Enterprise Workloads

• Broken RichText Tables: Domino tables and collapsible sections turn into unreadable plaintext or broken HTML tags.
• No Contacts or Calendars: IMAP can't touch address books or appointments; your names.nsf contacts stay trapped on the workstation.
• Dead DocLinks: Every internal Notes link (notes://...) turns into dead, unclickable text.

Approach 2: Convert NSF to Unicode PST & Ingest via AzCopy SAS Network Ingestion

For medium and large enterprise cutovers, the cleanest path is converting NSF mailboxes into 64-bit Unicode Outlook PST files and streaming them through Microsoft's Azure blob storage infrastructure.

+-------------------------------------------------------------+
| 1. Lotus Notes Databases (username.nsf + names.nsf)          |
+------------------------------+------------------------------+
                               |
                   [Engineered Conversion]
                               v
+-------------------------------------------------------------+
| 2. Standard Unicode PST (Decrypted, SMTP Mapped, RFC 5545)  |
+------------------------------+------------------------------+
                               |
                   [AzCopy High-Speed Upload]
                               v
+-------------------------------------------------------------+
| 3. Azure Ingestion Storage Blob (Microsoft 365 SAS URL)     |
+------------------------------+------------------------------+
                               |
                   [Purview Mailbox Injection]
                               v
+-------------------------------------------------------------+
| 4. Microsoft 365 Target Mailboxes & In-Place Archives        |
+-------------------------------------------------------------+

Converting NSF Databases to Clean Unicode PST

Use the Prism PST & NSF Migration Engine to convert NSF databases into Unicode .pst format. The engine maps Canonical addresses to SMTP aliases, decrypts items using the supplied user.id, and translates DocLinks into clickable attachments.

Uploading PST Files to Azure Storage via AzCopy

1. Open the Microsoft Purview portal (https://compliance.microsoft.com).
2. Go to Data Lifecycle Management > Microsoft 365 > Import.
3. Create a new import job and grab the Network Upload SAS URL.
4. Run AzCopy in Windows PowerShell:

# Upload converted NSF archives to Microsoft 365 Azure blob storage
.\azcopy.exe copy "D:\LotusNotes_PST_Exports\" "https://<StorageAccount>.blob.core.windows.net/ingestiondata?<SAS_Token>" --recursive=true

Creating the Ingestion Mapping CSV

Build a NotesMigrationMapping.csv file to route PST files into user mailboxes:

Workload,FilePath,Name,Mailbox,IsArchive,TargetRootFolder,ContentCodePage,SPFileContainer,SPPath,TargetType
Exchange,,Alice_Notes.pst,alice.smith@yourdomain.com,FALSE,/,65001,,,Mailbox
Exchange,,Bob_Notes.pst,bob.jones@yourdomain.com,FALSE,/,65001,,,Mailbox
Exchange,,Executive_Archive.pst,ceo@yourdomain.com,TRUE,/LotusNotesArchive,65001,,,Mailbox

Launching the Cloud Import Job

Upload your mapping CSV into the Purview dashboard. Microsoft 365 verifies the files, validates mailbox licenses, and streams the messages into Exchange Online.

Approach 3: Direct Automated Ingestion via Prism Migration Engine (Fastest Path)

Don't want to spend days wrestling with Azure SAS tokens, CSV mapping files, or Domino server-side daemons? An automated migration engine is the cleanest route.

The Prism Migration Engine reads NSF files directly from disk without needing an active Lotus Notes or Domino client.

Key Capabilities for Lotus Notes Cutover:

• Canonical Address Translation: Translates CN=Dev/OU=Server/O=Corp to dev@corp.com automatically using an imported user directory CSV.
• DocLink Extraction: Pulls target database metadata from notes:// pointers and embeds them as clean reference files.
• user.id Decryption: Unlocks encrypted emails by passing the user password and .id file directly during parsing.
• Full Folder Tree Preservation: Preserves customized Domino Views, Folders, Shared Mailboxes, and Archives.

+-------------------------------------------------------------+
| Select Source NSF File (e.g., C:\Notes\Data\mail\user.nsf)  |
+------------------------------+------------------------------+
                               |
+------------------------------v------------------------------+
| Decrypt Items & Convert RichText Bodies + Attachments       |
+------------------------------+------------------------------+
                               |
+------------------------------v------------------------------+
| Export to Unicode PST / Ingest to Microsoft 365 Direct      |
| -> Full calendar recurrence preserved                       |
| -> names.nsf contacts translated to Exchange contacts       |
| -> Zero server downtime                                     |
+-------------------------------------------------------------+

Technical Comparison of Migration Approaches

Post-Migration Verification & Health Checklist

Once your data is in the cloud, run through these quick checks before retiring the Domino servers:

1. Verify Folder Counts in PowerShell:

Connect to Exchange Online PowerShell and review folder item counts:

   Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

   Get-MailboxFolderStatistics -Identity "alice.smith@yourdomain.com" | 
       Select-Object FolderPath, ItemsInFolder, FolderSize

1. Test Reply-All Functionality:

Open a historical email in Outlook and hit Reply-All. Make sure all addresses resolve to standard internet email addresses rather than broken CN=... strings.

1. Audit Recurring Meetings:

Check monthly repeating meetings with exceptions (like changed meeting rooms) to make sure dates match the original Lotus Notes calendar.

1. Archive Retention:

Keep cold NSF archives on write-once storage (WORM) for the duration of your legal compliance hold policy.

Frequently Asked Questions

Can I convert Lotus Notes NSF files without installing Lotus Notes or HCL Domino?

Yes. Modern migration utilities like the Prism Migration Engine utilize direct binary decoders to read the underlying NSF B-Tree structure directly from disk, so you don't need the legacy Lotus Notes desktop client installed.

How are Domino DocLinks handled during Microsoft 365 migration?

Domino DocLinks use the proprietary notes:// URI protocol which only functions within an active Lotus Notes client. During migration, advanced converters extract the referenced document subject, database title, and unique Universal Note ID (UNID), appending a clean reference footer to the migrated Outlook message.

What happens to local database encryption during migration?

If an NSF database is protected with local encryption, you must provide the matching user.id file and password during conversion. The migration engine uses the ID file's private key to decrypt message bodies and attachments on the fly before writing them to the destination container.

How do I migrate Domino personal address books (names.nsf)?

Personal address books are stored in a separate database file named names.nsf. You can convert this file directly into standard vCard (.vcf) or Outlook PST contact folders, which can then be imported directly into the Microsoft 365 Global Address List (GAL) or personal contact folders.

Will migrating to Microsoft 365 break my Lotus Notes application databases?

Mail migration only transfers messaging data (emails, contacts, calendars, tasks). Custom Domino business applications (workflow databases, approval forms, CRM systems) must be separately modernized, replaced with Power Apps or SharePoint, or accessed via an archival Domino viewer.

Contextual Cross-Links & Related Guides

• 📖 How to Migrate Mozilla Thunderbird to Microsoft 365 ➔
• 📖 How to Convert MBOX to PST for Outlook 2026 ➔
• 📖 Export Office 365 Mailboxes to PST via PowerShell ➔
• 📖 How to Fix Outlook 50GB PST Size Limit Errors ➔
• 📖 Guide to Email File Formats: PST, OST, EML, MSG, MBOX, OLM ➔
• 🛠️ Explore Standalone PST & Mailbox Migration Tools ➔