How to Migrate PST to Google Workspace Domain-Wide (2026 Guide)

Migrating an organization from on-premises Exchange servers or local Outlook archives to Google Workspace presents logistical challenges. Ingesting dozens or hundreds of legacy PST files into employee cloud accounts cannot scale if administrators must prompt individual users for passwords or Multi-Factor Authentication (MFA) tokens.

While Google's default desktop tool (Google Workspace Migration for Microsoft Outlook / GWMMO) requires manual authentication per mailbox, enterprise administrators can leverage Google Cloud Service Account Domain-Wide Delegation to ingest PST data centrally from an administrative server.

┌────────────────────────────────────────────────────────┐
│  USER-BY-USER LOGINS VS DOMAIN-WIDE DELEGATION         │
├────────────────────────────────────────────────────────┤
│  MANUAL CLIENT METHOD:                                 │
│  - Requires interactive user login and MFA per machine │
│  - High administrative overhead for multi-user fleets  │
│                                                        │
│  SERVICE ACCOUNT DOMAIN-WIDE DELEGATION:               │
│  - Central migration server with Service Account JSON  │
│  - Ingests multiple PST archives concurrently          │
│  - No employee password prompts or interactive MFA     │
└────────────────────────────────────────────────────────┘

Step 1: Create a Google Cloud Service Account

To enable administrative impersonation without collecting user passwords, configure a dedicated service identity in Google Cloud:

1. Sign in to the Google Cloud Console (console.cloud.google.com) with Super Administrator privileges.
2. Create a new Google Cloud Project named "Workspace-PST-Migration".
3. Navigate to APIs & Services > Library and enable the following APIs:

• Gmail API
• Google Calendar API
• People API (for Contacts)

4. Navigate to IAM & Admin > Service Accounts and click Create Service Account.
5. Assign a descriptive name (e.g., pst-migration-agent) and proceed.
6. Open the newly created Service Account, navigate to the Keys tab, click Add Key > Create new key, and select JSON.
7. Download and store the generated .json private key file in a secure directory on your migration host.

{
  "type": "service_account",
  "project_id": "workspace-pst-migration",
  "private_key_id": "8f3e9b1...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...",
  "client_email": "pst-agent@workspace-pst-migration.iam.gserviceaccount.com",
  "client_id": "112348957291048291048"
}

Step 2: Authorize Domain-Wide Delegation in Google Workspace

Grant the Service Account authority to impersonate domain users for mail, calendar, and contact workloads:

1. Note the numeric Client ID from your downloaded JSON key file.
2. Sign in to the Google Workspace Admin Console (admin.google.com).
3. Navigate to Security > Access and data control > API controls.
4. Under Domain-wide delegation, click Manage Domain Wide Delegation.
5. Click Add new and paste your numeric Client ID.
6. Enter the required OAuth scopes into the OAuth scopes field (comma-delimited):

   https://mail.google.com/, https://www.googleapis.com/auth/calendar, https://www.googleapis.com/auth/contacts

7. Click Authorize to activate tenant-level delegation.

Step 3: Create the PST-to-User Mapping CSV

Prepare a CSV file mapping local or network PST file paths to their corresponding Google Workspace destination email addresses:

PstFilePath,TargetGoogleEmail
D:\Archives\JohnDoe.pst,john.doe@company.com
D:\Archives\SarahJ.pst,sarah.jenkins@company.com
D:\Archives\MichaelT.pst,michael.torres@company.com
\\SAN-STORAGE\Mailboxes\Finance.pst,finance-team@company.com

Automated Manifest Discovery via PowerShell

To generate this mapping automatically from a directory of PST files, run:

# Scan network directory for .pst files and compile mapping manifest
$StoragePath = "\\SAN-STORAGE\Mailboxes"
$ExportCsv = "C:\Migration\pst_import_manifest.csv"

Get-ChildItem -Path $StoragePath -Filter *.pst -Recurse | ForEach-Object {
    $UserAccount = ($_.BaseName.ToLower() -replace "archive_","") -replace "_202[0-9]",""
    [PSCustomObject]@{
        PstFilePath       = $_.FullName
        FileSizeGB        = [math]::Round($_.Length / 1GB, 2)
        TargetGoogleEmail = "$UserAccount@company.com"
        Status            = "Ready"
    }
} | Export-Csv -Path $ExportCsv -NoTypeInformation

Write-Host "Manifest generated at $ExportCsv" -ForegroundColor Green

Step 4: Execute Batch Ingestion via Prism Engine

Using Prism PST Converter Tool or Prism Gmail Backup Tool allows structured ingestion into Google Workspace:

┌────────────────────────────────────────────────────────┐
│  PRISM DOMAIN-WIDE INGESTION PIPELINE                  │
├────────────────────────────────────────────────────────┤
│  [Admin Workstation: Directory of PST Archives]        │
│             │                                          │
│             ▼ Service Account JSON Authorization       │
│  [Prism Multi-Stream Migration Controller]             │
│   ├── Stream 1: UserA.pst  -> user.a@domain.com        │
│   ├── Stream 2: UserB.pst  -> user.b@domain.com        │
│   └── Stream 3: Shared.pst -> info@domain.com          │
│             │                                          │
│             ▼ Google Workspace API Endpoints           │
│  [Target Google Workspace Domain Mailboxes]            │
└────────────────────────────────────────────────────────┘

1. Launch Prism PST Converter Tool on your migration server.
2. Select Domain-Wide Delegation / Enterprise Mode.
3. Browse and load your Service Account JSON key.
4. Load your CSV mapping manifest.
5. Configure folder tree mapping (converting Outlook folders to hierarchical Gmail labels).
6. Set message duplicate rules (skipping items with matching RFC Message-ID or hash).
7. Click Start Enterprise Migration to execute concurrent mailbox transfers.

Google Workspace API Limits and Quota Management

Google Workspace enforces per-user and per-domain API quotas:

MAPI Folder Hierarchy to Gmail Label Conversion

Outlook organizes mail into rigid folder trees, whereas Google Workspace uses flat labels with hierarchical tagging:

OUTLOOK FOLDER TREE                 GMAIL LABEL CONVERSION
===================                 ======================
Inbox                               INBOX
├── Finance                         INBOX/Finance
│   └── 2025 Audit                  INBOX/Finance/2025 Audit
Sent Items                          Sent
Deleted Items                       Trash (or Migrated_Trash)
Archive                             All Mail
Custom Department Archive           Custom Department Archive

When importing:

1. Preserve Message Headers: RFC 822 headers (Message-ID, In-Reply-To, References) must remain intact to preserve Gmail's conversation threading.
2. Handle Delimiter Characters: Outlook folders containing special characters are sanitized into valid Gmail label strings.
3. Read/Unread and Starred Flags: MAPI message status codes (MSGFLAG_READ) map to Gmail system attributes, and flagged tasks convert to Starred messages.

Post-Migration Verification and Cutover Audit

Before decommissioning legacy storage arrays:

1. Compare Item Counts:

Check total message counts between the source PST manifest and the Google Workspace destination mailboxes. Use GAM (Google Apps Manager) to run quick mailbox audits:

   gam user john.doe@company.com show messages query "label:INBOX/Finance" count

2. Audit Error Logs:

Open the Prism migration log directory and inspect exceptions.csv. Any emails rejected due to Google's 25MB attachment ceiling or blocked executable extensions are cataloged with their source Subject, Date, and internal Message-ID.

3. Verify Calendar and Contact Sync:

Log into a test account and verify that recurring appointments, invitee lists, and vCard address books mapped accurately.

Comparison of Domain Migration Approaches

Frequently Asked Questions (FAQs)

Is it safe to delete the Service Account after migration is complete?

Yes. Once all PST archives have been successfully ingested and verified in Google Workspace, you can safely delete the Service Account key from the Google Cloud Console to revoke all API permissions.

What happens if an employee already has some emails in their Google inbox?

Prism migration tools inspect existing messages and evaluate RFC Message-IDs and checksums to skip identical emails automatically, preventing duplicate entries.

How does the tool handle attachments larger than Google Workspace's 25MB limit?

Google Workspace strictly rejects any incoming email payload exceeding 25 megabytes. The tool logs oversized items in skipped_oversized.csv, exports the raw email and attachments to a dedicated local directory, and can insert a text reference into the user's thread noting the archived file.

Summary

Migrating legacy PST files to Google Workspace via Google Cloud Service Accounts and Domain-Wide Delegation provides a centralized, secure path for enterprise email onboarding. By avoiding manual user logins and client-side GWMMO bottlenecks, administrators can ingest multi-terabyte email archives smoothly using Prism PST Converter Tool and Prism Gmail Backup Tool.

Related Guides:

• How to Migrate Outlook PST to Gmail with OAuth 2.0
• How to Backup Gmail to External Hard Drive Without Takeout