S2Stools
01
Connect
One admin-consent click in Microsoft's own dialog connects your SharePoint — no certificate to create, no secret to paste, revocable by you at any time. Every plan, including free dry runs.
admin consent → connected · no key to enter
Spec 00 — site-to-site migration
SharePoint migration
that keeps the truth.
S2Stools moves SharePoint sites 1:1 — files, lists and pages arrive with their authors and timestamps, people matched to the target tenant's users, and the site notebook comes along. Turn them on, and item-level permissions and file version history move too. Each run ends with a report that checks what landed against the source.
Free preview · dry runs don't count against your allowance
/sites/marketing · source
Shared Documents 12,480 files
contract-2024.docx v1–v12
Team Lists 34 lists
Site Pages 86 pages
Permissions 14 principals
Site Notebook OneNote
/sites/marketing-new · faithful copy
Shared Documents 12,480 ✓
contract-2024.docx v1–v12 ✓
Team Lists 34 ✓
Site Pages 86 ✓
Permissions mapped ✓
Site Notebook renamed ✓
Spec 01 — process
Connect once, then three steps — no surprises at either end.
02
Estimate
Tell us the size of the source and the estimate sizes the job — GB, items, compute-hours — so you know which plan covers it before anything moves.
2,000,000 items · 500 GB · ~80 compute-hours (vCPU-hours)
03
Dry run
The engine walks the whole site and reports the plan — lists, pages, permissions, and the people and terms the run will hand the target — and writes nothing.
"DryRun": true — plan only, write nothing
04
Migrate & verify
Each run ends by comparing the target with the source — item counts, columns, views and content types. A run you pause or cancel resumes where it stopped: finished lists are skipped, and a list in progress picks up item by item instead of starting over. Cancel is one click, cooperative.
verification → counts · columns · views · content types
Spec 02 — fidelity
Authors. Permissions.
File history. Intact.
Most tools move files. S2Stools moves the record — the metadata trail your compliance team actually cares about.
File version history
Version chains on documents are replayed oldest-to-newest, each version keeping its own date, content and Modified By. List items and pages arrive at their current version.
File.Versions → replayed v1…vN
Authors & timestamps
Created/Modified and Created by/Modified by survive the move on files, pages and list items. Between tenants, each person is matched to a target user — a map row, a domain rule, or a fallback account you choose — and anyone left without a match is reported.
system fields stamped · no version bump
Item-level permissions
Turn on item-level permissions and broken-inheritance items keep their own grants for principals with a match on the target; site groups and M365 group claims are remapped. A grant whose principal has no match is skipped and named in the report.
opt-in · principals mapped source → target
Attachments
Turn on list-item attachments and they travel with their items, added before the final metadata stamp so dates stay true.
opt-in · AttachmentFiles copied per item
Navigation & notebook
Quick launch arrives without duplicate or dead links, and the site notebook is renamed for its new home.
system links stripped · notebook retitled
Managed metadata
Taxonomy columns, content types, and term groups are extracted together so nothing is silently dropped.
Fields + ContentTypes + TermGroups
People matched across tenants
The preview lists the people the run hands the target — Created by and Modified by, people columns, permissions — and whether each one resolves there, with a draft map to fill in. Match them by map row, by ordered domain rules such as @contoso.com → @fabrikam.com (user accounts only), or name a fallback account for content; permissions do not use it. Migrating across tenants comes with assisted setup — contact us.
map rows · domain rules · fallback for content
Spec 03 — pricing
Priced up front,
not from a sales call.
Flat monthly plans, each with a clear allowance — GB moved, compute-hours, items. Every run's usage is measured and shown under Usage & allowance; it updates when a run finishes or pauses.
Free / Trial
$0/mo
- 20 dry runs / month
- Full site inventory
- Cost estimate
- Previews only — upgrade to migrate
Most teams
Pro
$49/mo
- 100 GB included
- 25 compute-hours
- File version history
- Across tenants with assisted setup — contact us
Business
$199/mo
- 500 GB included
- 120 compute-hours
- 5 concurrent runs
- Priority queue · customer-managed keys
Enterprise
$999/mo
- 2,000 GB included
- 600 compute-hours
- 20 concurrent runs
- Customer-managed keys
1 compute-hour = 1 vCPU-hour. Migrations run on 2-vCPU workers, so 25 compute-hours is about 12.5 hours of migration time.
Each plan's allowance covers one billing period. When a run reaches it, it pauses; add a +100 GB pack ($39) to continue it (paid plans). Dry runs are free and don't count against your allowance. Set a per-run budget and the run pauses before it passes it.
Spec 04 — isolation & custody
Your tenant is a wall,
not a row filter.
- Your content never lands here. Files, versions, list items and attachments stream from your source straight to your target — held in memory for the length of the transfer, never written to our disks, never staged in our storage. What we keep for a run is the report, the usage record and the resume state: names, counts and timings, not documents.
- We hold no keys. Your SharePoint connects through one admin consent — we store only your tenant id and the fact of the grant, no secret or certificate of yours — and you revoke it from your own Entra portal.
- One storage container per tenant. Run artifacts never share a container; isolation is enforced at the storage boundary, not just in queries.
- Secrets stay out of requests. The API refuses a migration request whose sign-in settings carry a client secret, password or connection string.
- Entra ID sign-in. Your directory is the front door: first user provisions the tenant, roles map to scopes, API keys are scoped and revocable.
// the API, refusing a pasted secret
POST /v1/migrations → 422 Unprocessable Entity "Source.Auth.ClientSecret.ClientSecret: inline secrets are not accepted — use a Key Vault reference."
See your migration before you run it.
Every plan starts with a free preview: connect, pick a site, and get the full inventory and what the run would cost — before anything moves. Dry runs don't count against your allowance. Real migrations start on Pro at $49.