List everything the server does before you move anything. Tidy permissions and delete what you're not required to keep. Design SharePoint and Teams around how your services work, not around the old folder tree. Decide separately what happens to the finance and CRM systems, which often can't go into SharePoint. Then copy the data in stages, cut over on a weekend, train people on where things now live, and keep the old server read-only until you're sure nothing is missing.
Why so many charities are doing this now
Many charities still have a server in a cupboard running the shared drives, logins and an accounts package. There's a date on that: Microsoft ends extended support for Windows Server 2016 on 12 January 2027. After that there are no security updates unless you pay for Extended Security Updates, which Microsoft offers through Azure Arc. A server that stops being patched is exactly what attackers look for, and Cyber Essentials requires software to be supported.
Most charities already have Microsoft 365, so the question isn't whether to move but how to do it without losing files, breaking the accounts system or confusing volunteers on Monday morning. How to make good use of Microsoft 365 once you're there is covered in our guide chapter, How can charities get more from Microsoft 365?
Step 1: list everything the server actually does
Servers collect jobs over the years. The shared drives are obvious; the scan-to-folder on the photocopier and the old Access database someone built in 2014 usually aren't.
| On the old server | Where it usually goes | Watch out for |
|---|---|---|
| Shared drives (S:, G:) | SharePoint sites and Teams | Deep folder trees, and files nobody has opened in years |
| Personal home drives (H:) | Each person's OneDrive | Leavers' home drives still on the server |
| User logins (Active Directory) | Microsoft Entra ID, with devices in Intune | Shared logins and old accounts that need closing, not copying |
| Email (if on-site Exchange) | Exchange Online | Shared mailboxes and archive files (.pst) on people's PCs |
| Finance and CRM systems | Supplier's cloud version, hosted server, Azure, or stays put for now | Licence terms, integrations and who supports it |
| Scanned archives and old projects | An archive site, or secure deletion | Retention rules (see Step 4) |
| Printers and scan-to-folder | Cloud print or scan-to-email | Older copiers that can't scan to Microsoft 365 |
| Server backups | Separate Microsoft 365 backup | Microsoft's retention and version history aren't a backup |
Step 2: fix permissions before you move, not after
Old file servers tend to drift towards "everyone can see everything", or the opposite: a maze of one-off permissions set years ago for people who've since left. Copying that mess into SharePoint makes it harder to fix, and harder still once Copilot can surface anything a user has access to.
Start with the sensitive material: safeguarding, HR, case notes, anything with health or support information about beneficiaries. Decide which groups need access, for example the safeguarding lead and service managers, and give those areas their own SharePoint sites. Everything else can be more open. Grant access through groups by role, never to named individuals, so that when a volunteer coordinator leaves, access goes with the role and not with the person.
Step 3: design the new structure, don't clone the old one
A common mistake is recreating the S: drive as one enormous SharePoint library. It works on day one and causes problems within a year, and Microsoft's own limits explain why. The full path to a file, including folder names, can't be longer than 400 characters in SharePoint and OneDrive. Microsoft recommends syncing no more than 300,000 files across the libraries on any one computer. Individual files can be up to 250 GB.
A better pattern for most charities is one Teams team, with its SharePoint site behind it, for each service or function (Finance, HR, Fundraising, each service or project), a separate restricted site for each sensitive area, and a board site for trustees. People's own working files go in OneDrive.
Check storage too. Your organisation gets 1 TB of SharePoint storage plus 10 GB for each eligible licence. A 30-licence charity with 2 TB of old scans will run out of space unless it archives or deletes first.
Step 4: decide what you're allowed, and required, to keep
A migration is the cheapest time to delete things. Two rules pull in opposite directions. OSCR says Scottish charities must keep accounting records for at least six years from the end of the financial year they were made in, and funding agreements or other laws may require longer. UK GDPR says personal data shouldn't be kept longer than needed. So old volunteer application forms, closed case files past your retention period and CVs from 2016 shouldn't move at all.
Agree a simple retention schedule with the data protection lead before the migration, then apply it as you go. Move what you must keep into a read-only archive site. Securely delete what you don't need, and record that you did.
Step 5: deal with the systems that can't go into SharePoint
Desktop accounts packages and older donor or client databases often expect a server. You have four options: move to the supplier's cloud version, which is usually the cleanest; pay the supplier or a hosting firm to run it; run it on a small virtual server in Azure (eligible nonprofits get US$2,000 of Azure credits a year); or keep a small, patched on-site machine just for that system while everything else moves. Talk to each supplier early. Their licence terms and data export options often decide the timetable.
Steps 6 and 7: copy in stages, then cut over on a weekend
Microsoft's Migration Manager and SharePoint Migration Tool are free and handle file shares well. Use them in passes. A pre-scan flags file paths that are too long and characters SharePoint doesn't allow. A first bulk copy runs during the week while people keep working on the server. A final "delta" pass copies only what's changed. Test with a small pilot group, such as the finance team, before moving everyone.
For the cut-over, the old drives go read-only on Friday afternoon, the final pass runs over the weekend, and on Monday someone is on hand to help. Keep the old server switched on but read-only for a few weeks, then take a final backup, wipe it securely and recycle it properly.
Step 8: train people on "where do I save this?"
Staff and volunteers don't need a SharePoint course. They need a one-page guide: which Team holds what, OneDrive versus shared sites, sharing outside the charity and recovering deleted files. A 20-minute session per team works better than one long session for everyone. Remember that Microsoft's free Business Basic grant covers paid staff and trustees, not volunteers. Plan volunteer access before cut-over, not on the day. The options are covered in our guide chapter, How can a charity get good IT on a tight budget?
Worked example: a 40-person charity with a 2016 server
Example: a charity with 40 staff, 25 regular volunteers and a Windows Server 2016 machine holding 600 GB of shared files, home drives, a desktop accounts package and a client database. This is an illustration, not a real client.
| Week | What happens |
|---|---|
| 1 | Inventory of the server; licence check; suppliers of the accounts package and the database contacted |
| 2 | Permissions review with service managers; retention schedule agreed; 150 GB of expired files deleted |
| 3 | Teams and SharePoint sites built; Microsoft 365 backup switched on; pilot with the finance team |
| 4 | Bulk copy of the remaining data; the accounts package moved to the supplier's cloud version |
| 5 | Weekend cut-over; floor-walking on Monday and Tuesday; short team training |
| 6–9 | Server kept read-only; the client database moved to its new home; server wiped and recycled |
The costs to budget for are licences (reduced or free under Microsoft's nonprofit offers), the project work, any new version of the finance or CRM system, Microsoft 365 backup and time for training. Against that, set what you stop paying for: server replacement and Extended Security Updates.
How Indigo does this. Indigo Unified Communications is a Microsoft Solutions Partner for Modern Work with more than 100 Microsoft 365 migrations completed, and we support more than 30 Scottish charities from Glasgow. We document every system in IT Glue before we touch it, back up Microsoft 365 with Datto SaaS Protection and manage devices with Microsoft Intune. For Erskine, we moved the charity onto Microsoft 365 charity pricing and optimised its Azure licensing. Old equipment goes to a certified WEEE recycling partner. IT support for charities →
What to do next
- Find out which Windows Server version you're running. If it's 2016 or older, you have until 12 January 2027 at most.
- List every job the server does, including printers, scanning and any database someone built years ago.
- Ask your finance and CRM suppliers what their cloud or hosted options cost, and how long the move takes.
- Agree a retention schedule with your data protection lead before any data moves.
- Book a free Charity Technology Assessment and we'll scope the move with you.
Frequently asked questions
Can we move a charity file server to SharePoint ourselves?
Small, tidy file shares can be moved with Microsoft's free Migration Manager or SharePoint Migration Tool. But most of the risk is in permissions, long file paths, finance and CRM systems, and cut-over planning. If the server also handles logins, email or a line-of-business application, get help with planning at least.
What happens to our accounts or CRM software when the server goes?
It depends on the product. Many suppliers now offer a cloud version, which is usually the simplest route. Otherwise the software can be hosted by the supplier or a specialist, run on a small Azure virtual server using Microsoft's nonprofit Azure credits, or kept on a small patched machine while everything else moves.
How long does a charity server migration take?
It depends on how much data there is, how tidy it is and how quickly your finance and CRM suppliers move. In the illustration above, cut-over happens in week 5 and the server is switched off a few weeks later. Most of the time goes on planning, clean-up and waiting for suppliers, not on copying. The cut-over itself takes a weekend.
Is Microsoft 365 a backup of our files?
No. Microsoft keeps its service running and offers version history and recycle bins, but those have time limits and won't help if files are deleted or encrypted and nobody notices for weeks. Use a separate Microsoft 365 backup, kept outside your tenant, and test a restore.
Sources: Microsoft, Planning ahead for Windows Server 2016 end of support, 25 February 2026 (https://www.microsoft.com/en-us/windows-server/blog/2026/02/25/planning-ahead-for-windows-server-2016-end-of-support/) · Microsoft Learn, SharePoint limits (https://learn.microsoft.com/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits) · Microsoft Learn, Guide to migrating file shares to OneDrive, Teams, and SharePoint (https://learn.microsoft.com/sharepointmigration/fileshare-to-odsp-migration-guide) · Microsoft Learn, Overview: Migrate your file shares to Microsoft 365 (Migration Manager) (https://learn.microsoft.com/sharepointmigration/mm-get-started) · Microsoft Learn, Overview of the SharePoint Migration Tool (https://learn.microsoft.com/sharepointmigration/introducing-the-sharepoint-migration-tool) · Microsoft, Technology and software grants and discounts for nonprofits (https://www.microsoft.com/en-us/nonprofits/offers-for-nonprofits) · OSCR, A guide to charity accounts: 5. Accounting records (https://www.oscr.org.uk/managing-a-charity/charity-accounting/a-guide-to-charity-accounts/5-accounting-records/)
Related: Charity guide: Microsoft 365 for charities · Charity guide: IT on a budget · How to save money on Microsoft 365 licences · IT support for charities
Get a free technology assessment
One of our consultants will review your IT, security, connectivity and phones, then give you practical recommendations. No obligation.