Microsoft gives eligible nonprofits — including most churches and ministries — free or deeply discounted access to Microsoft 365, the same Exchange, Teams, and Office apps businesses pay $6-$22 per user per month for. The catch is that the application process runs through a validation partner, not Microsoft directly, and the paperwork trips up a lot of church admin teams who assume it works like a simple software download. This guide walks through exactly who qualifies, how the validation and grant request actually work step by step, what you get for free versus what still costs money, and the setup decisions that determine whether your migration goes smoothly or turns into a mailbox mess. If you're moving off a legacy provider (GoDaddy Email, Rackspace, an old on-prem Exchange server, or a denomination-run system), read this before you request the grant so your tenant is set up correctly from day one.
Microsoft's nonprofit program is administered through a validation partner (in the US, TechSoup; in most other countries, Percent or a local equivalent). To qualify, your church generally needs a recognized nonprofit or charitable status in your country — in the US that means 501(c)(3) status, though some faith-based validation paths accept church status without a separate IRS determination letter since churches are automatically tax-exempt under federal law.
Microsoft explicitly allows religious organizations into the nonprofit program, but with one important condition: the organization cannot discriminate in the provision of services, or in hiring for positions unrelated to religious duties, based on protected characteristics like race, gender, or disability. This isn't usually an issue for the grant request itself, but it is a line in Microsoft's nonprofit eligibility policy that gets churches rejected if their bylaws or public materials conflict with it in ways reviewers flag.
A few things that commonly disqualify or delay an application: government entities, non-501(c)(3) affiliated groups (some independent house churches without formal incorporation), and organizations that can't produce basic proof of legal existence — an EIN letter, articles of incorporation, or a state charity registration. If your church has never formally incorporated or applied for an EIN, do that first; it's a prerequisite for almost every step that follows.
The core grant is Microsoft 365 Business Premium — free for up to 300 users — which includes Exchange Online mailboxes (50GB each), Teams, SharePoint, OneDrive (1TB per user), and desktop Office apps (Word, Excel, PowerPoint, Outlook) installable on up to 5 devices per user. For most churches this fully replaces whatever email and file-storage setup they're currently paying for.
There's also a free tier for organizations over 300 users or those wanting a lighter plan: Microsoft 365 Business Basic (web/mobile Office apps + Exchange + Teams, no desktop installs) is available as a paid-discount option rather than free, so most churches under 300 staff/volunteers with mailboxes will want Business Premium.
What's NOT free: additional storage beyond the included quotas, Microsoft 365 Copilot (the AI add-on), Power BI Pro, and most premium security add-ons like Defender for Office 365 Plan 2 — these are offered at a steep nonprofit discount (often 75%+ off list price) but still cost money. Domain registration and DNS management (if you don't already have a domain host) are also outside the grant.
Go to TechSoup.org and create an organization account (not a personal account) using the church's legal name and EIN. TechSoup will ask for documentation proving nonprofit status — for a US church this is typically your EIN confirmation letter (Form SS-4 or the IRS CP 575 notice) plus either a 501(c)(3) determination letter or, for churches claiming automatic exemption, articles of incorporation and a signed statement of your religious/charitable purpose.
Validation isn't instant — budget 3-10 business days, longer if your documents are incomplete or your church's name on file doesn't exactly match your incorporation paperwork. This is the single biggest source of delay we see: a DBA ("doing business as") name that doesn't match the legal entity name on the EIN letter. Fix that mismatch before submitting, not after a rejection.
Once approved, TechSoup issues a validation token tied to your organization. You'll use this token — not a login you create yourself — to unlock the Microsoft nonprofit offer, so don't lose the confirmation email.
With your TechSoup validation in hand, go to Microsoft's nonprofit portal (nonprofit.microsoft.com) and sign in or create a Microsoft account for the organization — use a role-based email you control (e.g., admin@yourchurch.org), not a personal Gmail, since this account becomes your Global Administrator.
Select "Get started" under Microsoft 365, choose Business Premium, and enter your TechSoup validation token when prompted. This creates your Microsoft 365 tenant and provisions the free licenses. You'll assign the licenses (up to 300) to staff and volunteer email addresses from the Microsoft 365 admin center afterward — the grant doesn't auto-create mailboxes, you still set up each user.
A detail that trips people up: the free grant licenses have to be re-requested/renewed periodically in some regions, and Microsoft periodically re-verifies nonprofit status through TechSoup. Keep your TechSoup registration current (usually an annual re-validation) so licenses don't lapse unexpectedly.
Before anyone can send or receive mail at @yourchurch.org through the new tenant, you have to add and verify your domain in the Microsoft 365 admin center, which means adding a TXT record (for verification) and then MX, SPF, and eventually DKIM/DMARC records at your DNS host. If your domain currently points its MX records to an old provider, mail keeps flowing there until you cut over — so plan the DNS change for a low-traffic window (most churches do this Friday evening or early Monday).
The actual mailbox migration — moving existing mail, contacts, and calendars from your old system into Exchange Online — is a separate step from DNS cutover. Microsoft's admin center has a migration wizard for IMAP sources (works for most legacy webmail/cPanel setups); for on-prem Exchange or more complex sources, a third-party migration tool or a managed migration service is usually faster and safer than doing it by hand, especially if your church doesn't have in-house IT staff.
Sequence matters: validate mailboxes exist and are receiving test mail on the new tenant BEFORE you flip MX records for the whole domain, and keep the old inbox accessible read-only for at least a couple of weeks in case anything was missed.
The most common failure is submitting TechSoup validation under a name or EIN that doesn't match your official incorporation documents exactly — even a punctuation difference ("First Baptist Church" vs. "First Baptist Church, Inc.") can trigger manual review delays.
The second is assuming the grant is permanent regardless of activity — Microsoft's nonprofit terms require the organization to remain a validated nonprofit and to use the licenses for legitimate organizational purposes; reselling licenses, assigning them to unrelated third parties, or letting your TechSoup validation lapse can result in the grant being revoked.
The third is DNS sequencing: churches that flip MX records before mailboxes are provisioned and tested lose incoming mail during the gap. Always test in parallel first.
Finally, some churches request Business Premium licenses for far more users than they actually staff, planning to "grow into them." Unused licenses don't cost anything, but if usage looks inconsistent with your stated organization size during a re-validation, it can slow down renewal.
Get a free church email deliverability audit →Most churches qualify even without a separate IRS 501(c)(3) determination letter, since churches are automatically tax-exempt under US federal law. However, TechSoup (Microsoft's validation partner) still requires documentation proving your church is a legally organized entity — typically an EIN letter plus articles of incorporation or a similar founding document. Unincorporated house churches or informal groups without an EIN generally need to formalize first.
Up to 300 free Microsoft 365 Business Premium licenses per validated organization. That covers Exchange email, Teams, SharePoint, OneDrive, and desktop Office apps for each licensed user. Most churches use only a fraction of that (staff plus key volunteers), leaving headroom to add users later without a new application.
The core Business Premium licenses stay free as long as your nonprofit validation with TechSoup remains current, which typically requires periodic re-verification (commonly annual). There's no hidden switch to a paid tier for the base plan. What does cost money are add-ons outside the grant — extra storage, Copilot, premium security tiers, and phone-system add-ons — all offered at a nonprofit discount but not free.
TechSoup validation typically takes 3-10 business days if your documents are clean. Claiming the Microsoft grant and creating the tenant takes under an hour once validated. The variable part is migration and DNS cutover — a small church with a handful of mailboxes can be fully migrated in a day or two; a larger church migrating from an old on-prem Exchange server with years of mail history may need a week or more to migrate safely without losing data.
You can do it yourself using Microsoft's and TechSoup's documentation, but the validation paperwork and the mailbox migration are exactly where most volunteer-run church IT setups get stuck — mismatched legal names, DNS records added in the wrong order, or mail lost during cutover. A migration specialist familiar with church nonprofit grants can handle validation, domain verification, and a zero-downtime mailbox migration end to end, which is usually worth it if no one on staff manages IT full-time.