Every one of these came from an actual migration, not a hypothetical — here's exactly what each means and how to fix it.
"unauthorized_client... Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested"
This happens when the service account's domain-wide delegation is authorized with the wrong OAuth scopes — most setup guides list an incomplete or outdated list. The scope string Microsoft's own migration actually requires is:
https://mail.google.com/,https://www.googleapis.com/auth/calendar,https://www.google.com/m8/feeds/,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/contacts
Paste that exact string into Google Admin → Security → API Controls → Manage Domain Wide Delegation for the service account's Client ID, then wait 15–30 minutes for it to propagate before retesting.
"Error creating endpoint — The last connection attempt happened too recently. Please wait until [time] before trying to connect to an endpoint"
The Exchange admin center's migration wizard applies an escalating cooldown to repeated endpoint-creation attempts — each retry pushes the wait time further out, from a few hours to well over a day. Retrying through the same wizard screen makes this worse, not better. The fix: stop using the web wizard entirely and validate your setup with the Test-MigrationServerAvailability PowerShell cmdlet instead — it uses a separate code path that doesn't share this lockout, so you can safely re-check as often as you need while you fix scopes or wait on propagation.
Google Workspace IMAP migration stuck / paused after a few GB, resumes days later
Google enforces a hard 2,500 MB (2.5 GB) per 24 hours download cap over IMAP on every Workspace account — permanent Google policy, not a bug, and not something a Workspace admin can raise. A mailbox with several GB of history can take multiple days to move over IMAP as a result. The Gmail API has a dramatically higher quota ceiling and isn't subject to this cap at all — migrating through it instead of IMAP is usually the difference between a migration finishing in hours versus days.