Amazon WorkMail ends 2027-03-31. The export moves your mail, not your contacts, aliases or rules.

AWS names third-party providers and ships an export job. The export is honest about what it skips. This page lists that, what you rebuild by hand, and the trap one day after the deadline that catches DIY moves to Microsoft 365.

The dates

• New customers blocked since 2026-04-30.
• End of support 2027-03-31. "After March 31, 2027, you will no longer be able to access the Amazon WorkMail console or Amazon WorkMail resources." (AWS)
• 2027-04-01: Microsoft disables EWS permanently, one day later. That matters if your migration tool writes to Microsoft 365 through EWS (our EWS page).

What is not carried over

Two source classes, never blurred: the vendor's own docs are authoritative; community reports are real, dated and linked, but not vendor-confirmed, and they are labelled that way.

From the vendor's published docs

• "This action exports all email messages and calendar items … Other items, such as contacts and tasks, are not exported." The job reports them as totalNonExportableItems: "unsupported items like notes and contacts" (export guide).
• Listed prerequisite for the export: "The ability to program." It runs through S3, KMS and IAM.
• AWS provides no migration tool of its own. The end-of-support page names third-party providers.
• Aliases, groups, rooms and equipment resources, mail-domain DNS and the SES inbound receipt rules that route WorkMail mail are not in any export, so they are rebuilt by hand.

The price trap

• WorkMail is priced per user per month with 50 GB of mailbox storage included (widely reported as $4; the AWS page renders the figure in script).
• Microsoft 365 Business Basic rose from $6 to $7 per user per month on 2026-07-01 (Microsoft), about 75% more per mailbox. Google Workspace Business Starter is similar, with 30 GB pooled rather than 50 GB each.
• Cheaper providers exist, usually with less storage. Move 50 GB mailboxes onto a smaller quota and you find out during the copy.

Reported by users, not confirmed by the vendor

• No built-in path from WorkMail to Microsoft 365; IMAP migration "loses folder structure, has no checkpointing" and fails after repeated transient errors (2026-04-08).
• After a week, 3,500 of 300,000 emails had transferred; the target provider blamed WorkMail throttling IMAP (2026-05-19, unresolved).
• "What should Amazon WorkMail users do after its discontinuation?" (2026-09-23, only an automated answer).

Check your own setup

Read-only AWS CLI calls with your own profile: users, aliases, groups, resources, domains, the active SES rule set and journaling. It never asks for, stores or transmits a credential: you run it with your own login, and nothing leaves your machine.

aws workmail list-organizations --query 'OrganizationSummaries[].[OrganizationId,Alias]' --output text
bash check.sh <organization-id> [region]
bash check.sh --demo

The part nobody checks

A mail migration is usually signed off on message counts. The things people notice on Monday are the ones that are not messages: the shared address that no longer delivers because its alias was not recreated, the room that cannot be booked, the contact list that is empty, the inbound rule that used to copy invoices to a bucket. Test each of those by sending real mail to every address and alias after cutover, and compare the contact and folder counts per user.

If you would rather not do it yourself

We take this on as fixed scope, and we will say plainly that you would be among our first customers for this particular engagement. What we bring is the breakage map above and a hard habit of proving the new setup works rather than assuming it.

• Exit audit, fixed price. We run the checker against your organization, pick the target with you on cost and storage, and hand back the rebuild list (aliases, groups, resources, DNS, SES rules, journaling), a contact and task export plan, and a cutover order.
• Migration with proof, fixed price quoted by email on mailbox count and data volume. We move mail, calendars and contacts, rebuild routing, avoid EWS-based paths, and finish with a delivery test to every address and alias.