---
title: "Box to SharePoint Migration: Permissions, Box Notes & Metadata"
slug: box-to-sharepoint-migration-permissions-box-notes-metadata
date: 2026-05-08
author: Raaj
categories: [SharePoint, Migration Guide, Box]
excerpt: "Technical guide to Box-to-SharePoint migration covering storage limits, Box Notes conversion, permission mapping, tool comparison, and which features don't transfer."
tldr: "Box-to-SharePoint migration success hinges on storage audits, Box Notes .docx conversion, permission redesign before migrating, and knowing which features silently break."
canonical: https://clonepartner.com/blog/box-to-sharepoint-migration-permissions-box-notes-metadata/
---

# Box to SharePoint Migration: Permissions, Box Notes & Metadata


Most enterprises migrating from Box to SharePoint Online are doing it for one reason: **Microsoft 365 consolidation**. When you're already paying for E3 or E5 licenses that bundle SharePoint Online and OneDrive, a separate Box invoice is a hard sell to the CFO. Add Copilot readiness, tighter Entra ID integration, and the operational overhead of managing two file platforms, and the business case writes itself.

Box is not a legacy system, nor is it technically inferior. It is a highly capable, folder-centric cloud storage platform built on a different architectural paradigm than SharePoint. Box organizes content around personal and shared folders with a flat, permission-heavy hierarchy. SharePoint is a site-based document management system governed by Microsoft 365 Groups, managed metadata, and strict storage quotas. <cite index="4-8,4-9">A lot of businesses have gravitated towards consolidating their cloud operations into a single cloud suite like Microsoft 365 for various use cases, such as simplifying fee structure, improving security, maintaining data governance, and more.</cite>

If you treat this migration as a drag-and-drop exercise, you will hit path-length limits, lose proprietary file formats like Box Notes, and create a broken-inheritance nightmare that takes months to unravel.

This guide covers the storage math, the Box features that silently don't transfer, how to handle Box Notes conversion, and why permission mapping — not file transfer — is the hardest part of this project.

## Pre-Migration Audit: Storage, Permissions, and File Inventory

Start here. Every failed migration traces back to skipping the audit.

### Storage Volume Reconciliation

Box offers unlimited storage on its business and enterprise tiers. Users treat it as a bottomless hard drive, storing everything from active project files to decade-old video assets. SharePoint Online does not work that way. The standard allocation is **1 TB per tenant, plus 10 GB per licensed user**. An organization with 500 users has a total SharePoint storage pool of roughly 6 TB. If your Box instance currently holds 30 TB, migrating everything directly into SharePoint will trigger massive overage fees.

<cite index="2-1">Since SharePoint has limits and Box doesn't, taking the time to audit the data and find out what actually needs to be in SharePoint can save money as well as keep the data in SharePoint better organized.</cite> Run a data profiling scan to identify duplicates, stale files (untouched for 2+ years), and ROT data (Redundant, Obsolete, Trivial). Most enterprises find 30–50% of their Box data doesn't need to migrate at all. Route stale data to cheaper cold storage — such as Azure Blob Storage — rather than consuming premium SharePoint quota.

### File and Path Inventory

<cite index="58-15">The entire decoded file path, including the file name, can't contain more than 400 characters for OneDrive for home, OneDrive for work or school and SharePoint in Microsoft 365.</cite> Deep Box folder hierarchies with long filenames will fail silently during migration if paths exceed this limit. Spaces decode to `%20`, rapidly consuming your character budget. Scan for deep directory trees before migration and flatten them.

Good news on filenames: <cite index="5-7">both don't allow the same set of characters " * : < > ? / \ |</cite> — so illegal-character renaming is minimal for Box-to-SharePoint moves.

If you're using Microsoft's Migration Manager, be aware of hard planning constraints: a single migration task should not exceed 100,000 items or 1 TB of data. Large Box accounts should be split into smaller tasks by root folder. ([learn.microsoft.com](https://learn.microsoft.com/en-us/sharepointmigration/mm-box-step2-scan-assess))

### Permission and External Collaborator Inventory

Before migrating a single file, export a complete map of:

- **All Box folder-level collaborators** (Owner, Editor, Viewer, Uploader roles)
- **External collaborators** — every guest user with shared access
- **Box Groups** — which will need to become SharePoint Groups or Entra ID security groups
- **Folders with unique permissions** — where access differs from the parent

Do not rely on memory for guest access. Use Box reports to identify content shared with external users — that inventory becomes your re-invite list after cutover.

This permission map is the blueprint for your SharePoint permission design. For guidance on how SharePoint permission inheritance works, see [The Definitive Guide to SharePoint Permissions & Security](https://clonepartner.com/blog/blog/sharepoint-permissions-security-best-practices-2026/).

### Box Notes Identification

Run a query to identify every `.boxnote` file in the environment. Box Notes are a proprietary format incompatible with Microsoft Office. They require a dedicated conversion workflow — covered in detail below.

## Folder and Site Mapping Decisions

Do not replicate your Box folder tree in SharePoint 1:1. This is the most common mistake. The mapping should follow this pattern:

| Box Source | SharePoint Target | Notes |
|---|---|---|
| **Personal folders (per user)** | **OneDrive for Business** | Pre-provision OneDrive accounts before migration |
| **Team/department folders** | **SharePoint document libraries** (one per team site) | Design site architecture first |
| **Archived or cold data** | **Azure Blob Storage** or archive site | Don't burn SharePoint quota on files no one opens |
| **Project-specific folders** | **SharePoint sites** or Teams channels | Consider hub site architecture |

Avoid dumping everything into a single Document Library. SharePoint's **5,000-item list view threshold** degrades filtered views and breaks default list rendering. The threshold is a view and query limit, not a storage cap — but it directly affects usability. Use the migration to flatten folder trees where possible and shift classification into metadata, content types, and search filters.

If your Box environment uses metadata templates, tags, or folder descriptions worth preserving, define target SharePoint site columns and content types before migration. Migration Manager and FastTrack can carry Box tags and advanced metadata forward, but they need a destination schema to map into. Dumping metadata into ad-hoc text fields loses the search, retention, and reporting value.

For guidance on metadata-driven architecture in SharePoint, see [Mastering SharePoint Information Architecture](https://clonepartner.com/blog/blog/sharepoint-metadata-vs-folders-information-architecture/).

> [!WARNING]
> **OneDrive pre-provisioning:** <cite index="39-15,39-16">If you choose OneDrive as the destination, pre-provision OneDrive for users in your organization before migration. Otherwise, the OneDrive destinations aren't going to pass validation, causing migrations to fail.</cite>

If you're using Migration Manager, note that destinations cannot be changed once migration starts. Get the mapping right before the first pass. ([learn.microsoft.com](https://learn.microsoft.com/en-us/sharepointmigration/mm-box-step4-review-destinations))

## What Migrates and What Doesn't

This is where most migration guides lie by omission. Several Box-native features **do not transfer** to SharePoint, regardless of tool.

### What Migrates

- Files and folder structures
- File metadata (created date, modified date, modified-by attribution)
- Internal sharing permissions (mapped via identity mapping)
- Box Notes (converted to `.docx` with caveats — see below)

### What Does NOT Migrate

- **Box Shared Links** — <cite index="41-2">Shared links are not migrated and must be recreated in SharePoint.</cite> Every external or internal URL pointing to Box content breaks.
- **Box Comments** — Tool-dependent. Cloudiway documents that comments are not migrated, while Microsoft FastTrack documentation says Box comments do migrate. Validate with your exact tool and version before promising comment fidelity. ([cloudiway.com](https://cloudiway.com/documentation/box-to-sharepoint-migration/))
- **Box Tasks** — Task assignments within Box do not transfer. Recreate them in Planner or Microsoft To Do.
- **Box Relay Workflows** — <cite index="27-13">Box Relay workflows and custom automations require recreation using Power Automate.</cite>
- **External Collaborators** — <cite index="70-20,70-21">Migration Manager doesn't share content with external collaborators. This policy is in place to protect your organization, and industry best practice is to never automatically share sensitive internal data with external collaborators.</cite> You must re-invite them manually.
- **File Version History** — <cite index="33-32,33-33">Migration Manager does not preserve file versions. During a migration, only the most recent version of a file is transferred.</cite> If version history matters, evaluate third-party tools that support version migration.
- **Third-party App Integrations** — Box apps connected via OAuth must be reauthorized or replaced in the Microsoft 365 ecosystem.

> [!NOTE]
> **Plan for Power Automate rebuilds:** Any workflow logic in Box Relay needs to be rebuilt in Power Automate. Power Automate is capable but architecturally different — its SharePoint connector `Get items` action defaults to returning 100 results, and you must configure pagination for larger datasets. See our [SharePoint Import Guide](https://clonepartner.com/blog/blog/how-to-import-data-into-sharepoint-methods-limits-tools/) for workarounds.

## How to Handle Box Notes Conversion

**Box Notes are a proprietary format.** They are essentially HTML and JSON wrappers stored within Box's infrastructure. They cannot be opened in Microsoft Word, Excel, or any Office application. If they land in SharePoint unconverted, users get broken files — either raw JSON text or a download prompt for a file their system cannot open.

<cite index="74-1">Box Notes are converted during migration to a .docx format</cite> when using Microsoft's Migration Manager. But the conversion has documented gaps: <cite index="71-1,71-2">Migration Manager now supports converting Box notes to .docx format. Note: Certain elements such as File Preview, Table of Contents, and Annotations are omitted during the conversion process.</cite>

The conversion history has been inconsistent — Microsoft temporarily removed Box Notes conversion from Migration Manager before re-adding it. If your organization relies heavily on Box Notes with embedded tables of contents, annotations, or file previews, verify the conversion output before committing to a full migration.

Third-party tools handle Box Notes with varying fidelity:

- <cite index="25-5">CloudFuze can migrate Box Notes files as .docx files in SharePoint Online without any data loss or file corruption risks.</cite>
- <cite index="27-7">Cloudiway converts Box Notes to compatible formats like Word documents or Google Docs.</cite>
- <cite index="10-6,10-7">Movebot will automatically convert Box Notes into JSON. All the data will be there, but it includes formatting in JSON.</cite> (Not `.docx` — requires post-processing.)
- ShareGate and AvePoint (Fly) convert to `.docx` with tool-specific fidelity.

**Recommendation:** Run a pilot batch of 50–100 Box Notes through your chosen tool. Open every converted `.docx` and verify formatting, embedded images, tables, and checklists before migrating the full corpus. Keep an ID map from original Box Note to new SharePoint document so support teams can trace problem files later.

## Permission Migration: The Hardest Part of the Move

File transfer is the easy part. Getting permissions right is where Box-to-SharePoint migrations stall, break, or create security gaps.

### Why Permissions Don't Map Cleanly

Box uses a **folder-level collaboration model**: you invite a user as an Owner, Editor, Viewer, or Uploader on a specific folder, and that permission cascades to everything inside. It is flat and explicit.

SharePoint uses a **site-and-library inheritance model** with SharePoint Groups, Entra ID security groups, permission levels (Full Control, Edit, Read, Contribute), and the ability to break inheritance at any folder, file, or list item. Every time you break inheritance, you create a **unique permission scope**.

Microsoft supports up to 50,000 unique permission scopes in a library but recommends staying under 5,000 for performance. Those scopes do not clean themselves up if you later move files into a folder with matching access. ([learn.microsoft.com](https://learn.microsoft.com/en-us/sharepoint/manage-permission-scope))

> [!CAUTION]
> **Do not copy a messy Box permission model 1:1 into SharePoint.** Redesign the target first, then map into that design. Otherwise you trade one access model for a broken-inheritance cleanup project.

### Box-to-SharePoint Permission Mapping

| Box Role | SharePoint Equivalent | Notes |
|---|---|---|
| Owner | Site Owner / Full Control | Map carefully — Site Owner grants broad admin rights |
| Editor | Edit or Contribute | "Edit" includes delete; "Contribute" doesn't |
| Viewer | Read | Direct mapping |
| Uploader | Contribute (custom) | No direct SharePoint equivalent |

### Design Permissions Before Migration

Do not migrate permissions and fix them later. That approach creates broken inheritance that is extremely difficult to audit or clean up.

Before migration:

1. **Stop mimicking Box.** Do not recreate Box's folder-level sharing in SharePoint.
2. **Create SharePoint Groups** (or Entra ID security groups) mapped to Box's collaboration structure.
3. **Apply permissions at the Library or Site level**, not folder-by-folder.
4. **Decide where inheritance will break** — and document why.
5. **Configure external sharing policies** at the tenant and site level before migration day.
6. **Note the 100,000-item sharing limit** — a folder cannot be uniquely shared if it already exceeds 100,000 items. ([learn.microsoft.com](https://learn.microsoft.com/en-us/sharepoint/manage-permission-scope))

For a full walkthrough, see [The Definitive Guide to SharePoint Permissions & Security](https://clonepartner.com/blog/blog/sharepoint-permissions-security-best-practices-2026/).

### External Collaborator Re-invitation

Box external collaborators do not migrate automatically. You need to:

- Export the full list of external users with access from Box
- Decide which external users should retain access in SharePoint
- Configure SharePoint external sharing at the tenant level (off by default in many enterprise configs)
- Re-invite external users via SharePoint sharing after migration

## Box to SharePoint Migration Tools

A critical distinction most guides miss: Microsoft offers two migration tools, and only one supports Box.

### Microsoft's Free Tools

**SPMT (SharePoint Migration Tool)** is Microsoft's free, downloadable migration tool — but it **does not support Box as a source**. <cite index="11-11">SPMT is a free and easy to use migration solution to help you migrate content from on-premises SharePoint sites to Microsoft 365.</cite> It supports SharePoint Server and local file shares only. ([learn.microsoft.com](https://learn.microsoft.com/en-us/sharepointmigration/introducing-the-sharepoint-migration-tool))

**Migration Manager** (in the SharePoint Admin Center) **does support Box.** <cite index="34-2">The ability to migrate from Google Drive, Box, Dropbox, and Egnyte is fully integrated into Migration Manager.</cite> It is free, handles identity mapping, includes incremental (delta) sync, and converts Box Notes to `.docx`. Key limitations: no file version history migration, no shared link recreation, a maximum of <cite index="36-4,36-5">50 task rows running simultaneously</cite>, and 100,000-item or 1 TB per-task guidance.

### Third-Party Migration Platforms

| Tool | Strength | Box Notes Handling | Notes |
|---|---|---|---|
| **ShareGate** | Best-in-class permission fidelity for M365 | Converts to `.docx` | Requires careful configuration for Box sources |
| **AvePoint (Fly)** | Cross-platform (Box, Dropbox, Google Drive to M365) | Converts to `.docx` | Enterprise-grade |
| **CloudFuze** | Strong on hyperlink fixing and URL redirection | Converts to `.docx` | Good for link-heavy environments |
| **Movebot** | Simple pay-per-TB pricing, fast scanning | Converts to JSON (not `.docx`) | Requires post-processing for Box Notes |
| **Cloudiway** | Delta sync, MSP-friendly, clear gap documentation | Converts to Word/Google Docs | Good for phased migrations |
| **CloudM** | Broad cloud-to-cloud coverage | Tool-dependent | General-purpose |

These are listed as options, not endorsements. The right tool depends on your volume, permission complexity, Box Notes density, and whether you need delta sync or version history.

## Migration Approaches by Complexity

### DIY with a Tool (1–5 TB, Simple Permissions)

Works if you have a small-to-medium Box instance with straightforward folder-level permissions and minimal external collaborators. Pick a tool, run a pilot batch, validate, migrate in phases.

**Best for:** Small IT teams, single-department moves, straightforward folder structures.

### Phased Migration with Parallel Sync (Zero-Downtime Enterprises)

Pre-stage the bulk of data using delta sync while users continue working in Box. Run incremental passes over days or weeks, then execute a short cutover window. <cite index="27-22">Migrate data in advance while users continue working in Box, then complete a quick cutover.</cite>

**Best for:** Enterprises that cannot tolerate downtime, organizations running concurrent Box and SharePoint during transition.

> [!WARNING]
> **Do not rename or restructure during migration.** <cite index="70-14,70-15,70-16">The risks that come with rearranging content during the migration are primarily in the form of data duplication; the incremental process sees all changes as new data. If you change a folder name at the root, it detects that as a new folder, and all of the contents is retransferred, including all subfolders.</cite>

### Managed Service (50 TB+, Complex Permissions, Compliance)

For large enterprises with tens of thousands of users, complex permission trees, external collaborator webs, compliance requirements (HIPAA, SOX, financial services), or aggressive timelines — a managed migration service is the lower-risk path. A dedicated engineering team handles API rate limits, Box Note conversions, permission redesign, delta sync management, and post-migration validation.

## Post-Migration Validation and Decommissioning

The migration is not over when the progress bar hits 100%. Run these checks before declaring success:

- **File count reconciliation** — Compare total file counts between Box source and SharePoint destination. Account for files skipped due to path length, zero-byte files, or unsupported types.
- **Permission audit** — Spot-check 10–20 folders across different permission levels. Verify the right users have the right access. Ensure no unintended "Everyone except external users" permissions were applied to sensitive HR or Finance libraries.
- **External collaborator audit** — Verify that all required vendors and partners have redeemed their Entra ID guest invitations and can access their designated content.
- **Box Notes conversion verification** — Open a representative sample of converted `.docx` files. Check formatting, tables, embedded images. Watch for silently dropped annotations and tables of contents.
- **Link rewriting** — Internal documents referencing Box URLs now have broken links. Identify and update the highest-traffic ones. Broken Box URLs circulate in emails, wikis, and Slack for years.
- **List view threshold** — If any document library exceeds 5,000 items, verify that list views are indexed properly.

For target-side audit techniques, see [How to Export Data from SharePoint](https://clonepartner.com/blog/blog/how-to-export-data-from-sharepoint-methods-limits-migration-prep/).

### Decommissioning Box

Do not cancel your Box subscription the day after migration. Run both platforms in parallel for a minimum of **30 days** — 60 days for large enterprises or regulated industries.

During the parallel window:

1. **Set Box to read-only** for all users to prevent new content creation
2. **Monitor SharePoint adoption** — watch for users reverting to Box out of habit
3. **Run a final delta sync** at the end of the window to catch stragglers
4. **Export Box admin reports** and archive them for compliance (audit trail of who had access to what)
5. **Cancel Box licenses** only after all stakeholders confirm the move is complete

## What Decides Whether This Goes Well

The file transfer itself is the easy part. What determines success or failure:

- **Storage audit thoroughness** — migrate what matters, not everything
- **Permission design before migration** — not after
- **Box Notes conversion validation** — don't assume it worked
- **External collaborator re-invitation plan** — don't leave partners locked out
- **Link rewriting strategy** — broken Box URLs persist longer than you expect

If you're running a straightforward 1–5 TB move with simple permissions, Migration Manager or a third-party tool will get you there. If you're dealing with 50 TB+, complex cross-department permissions, external collaborator webs, or compliance requirements — that's where having a team who has done this repeatedly makes the difference.

> **Need to move from Box to SharePoint without breaking permissions?**
> ClonePartner runs Box-to-SharePoint migrations as an engineering service — storage auditing, permission design, Box Notes conversion, and post-migration validation included. [See how it works →](https://clonepartner.com/migrate/box-to-sharepoint)
>
> [Talk to us](https://cal.com/clonepartner/meet?duration=30)

## Frequently asked questions

### Does the SharePoint Migration Tool (SPMT) support Box as a source?

No. SPMT only supports on-premises SharePoint Server and local file shares. For Box, use Microsoft's Migration Manager (free, in the SharePoint Admin Center) or a third-party tool like ShareGate, AvePoint, CloudFuze, Movebot, Cloudiway, or CloudM.

### What happens to Box Notes when migrating to SharePoint?

Box Notes are a proprietary format incompatible with Microsoft Office. Migration Manager and most third-party tools convert them to .docx, but elements like File Preview, Table of Contents, and Annotations may be omitted. Movebot converts to JSON instead of .docx. Always run a pilot batch and verify the output before a full migration.

### Do Box sharing permissions transfer to SharePoint automatically?

Internal permissions can be mapped using identity mapping in Migration Manager or third-party tools. External collaborators must be re-invited manually — Migration Manager does not share content with external users by design. Shared links are not migrated and must be recreated.

### What Box features do NOT migrate to SharePoint?

Box Shared Links, Tasks, Relay workflows, third-party app integrations, external collaborator access, and file version history (in Migration Manager) do not transfer. Box Comments are tool-dependent — Cloudiway says they don't migrate, while Microsoft FastTrack says they do. Validate with your exact tool.

### How long should I keep Box active after migrating to SharePoint?

Keep Box running in read-only mode for a minimum of 30 days after migration — 60 days for large enterprises or regulated industries. Run a final delta sync before canceling to catch any missed files.