SUSTAINABLE GROWERS RWANDA
P.O BOX 864 Kigali, Rwanda
INVITATION TO BID
Title of Tender: Provision of Migration Services for Google Workspace to Microsoft 365 and Mac Device Management
Tender Reference Number: MSGWS/10/2026
Procurement Method: Open Tender
Date of Issue: 13 October 2026
Submission Deadline: 23 October 2026 at 5:00 PM (17h00) Kigali time
I. Introduction
Sustainable Growers Rwanda (SGR) is a non-governmental organization that specializes in innovative coffee cultivation training for smallholder women coffee farmers, with the goal of increasing their visibility in the coffee supply chain. Supported by Bloomberg Philanthropies and the governments of Rwanda, the Democratic Republic of Congo and Tanzania, SGR has reached over 77,000 women farmers and over 341,000 family members.
SGR currently runs on Google Workspace and uses Apple MacBooks exclusively. It intends to move to Microsoft 365 Business Premium and adopt cloud-native identity and device management through Microsoft Entra ID and Microsoft Intune. SGR has approximately 19 users and will not deploy or maintain any on-premises infrastructure.
SGR is therefore seeking a qualified Microsoft partner to plan and deliver the migration, configure the tenant and its security baseline, bring the MacBook estate under management, and hand over a documented environment that the SGR IT Manager can operate independently.
II. General Qualifications and Required Documents
The objective of this tender is to identify a professional, experienced firm to deliver a complete Google Workspace to Microsoft 365 migration and Mac device management implementation for SGR.
1. Administrative documents (mandatory, pass/fail)
- Registration certificate from RDB
- Valid tax clearance certificate from Rwanda Revenue Authority (RRA)
- Valid social security clearance certificate from RSSB, if applicable
- Confirmation that the bidder has an Electronic Billing Machine (EBM)
- Evidence of current Microsoft Partner status (e.g. Microsoft AI Cloud Partner Program listing or partner ID)
- At least three (3) completed Microsoft 365 migration or configuration projects; at least one should include migration from Google Workspace or another non-Microsoft platform
- Demonstrated experience managing Apple macOS devices through Microsoft Intune, with at least one reference.
Administrative requirements for international bidders. This tender is open to qualified national and international firms. In place of items 1 to 4 above, international bidders must submit valid company registration documents and equivalent tax compliance certificates or other applicable statutory documents issued by the competent authorities in their country of establishment, subject to SGR’s verification and acceptance.
2. Pricing instructions
- All prices must be quoted in Rwandan Francs (RWF), with VAT shown separately and included in the total. International bidders must convert their prices into RWF and state the exchange rate and date used.
- Migration and implementation services must be quoted at standard commercial rates and itemized separately from any Microsoft licensing costs.
- Any optional item, assumption or exclusion must be stated separately. SGR will not accept unapproved hidden or post-award charges.
- Prices shall not change for the duration of the contract.
Pricing and withholding taxes. International bidders shall ensure that their financial quotations take into account all applicable taxes and statutory deductions under Rwandan law, including withholding taxes (WHT). Where applicable, withholding tax shall be deducted and remitted to the Rwanda Revenue Authority in accordance with the law. Bidders should factor this tax treatment into their quoted prices, as withholding tax shall not constitute an additional payment over and above the accepted contract price.
III. Terms of Reference
1. Objectives
The objective of this assignment is to contract a qualified service provider to:
- Migrate SGR from Google Workspace to Microsoft 365 Business Premium without permanent loss of mail, calendar or file data.
- Establish Microsoft Entra ID as the primary identity platform for all users and connected applications.
- Implement Microsoft Intune for management of all SGR macOS devices.
- Configure Microsoft security and compliance baseline controls, including MFA, Conditional Access, self-service password reset and Microsoft Defender for Business.
- Migrate Gmail, Google Calendar and Google Drive content to Exchange Online, OneDrive and SharePoint Online, validated against an agreed test plan.
- Create Apple Business Manager (ABM), integrate it with Entra ID and Intune, and recommend a future device procurement and enrolment path.
- Provide knowledge transfer, administrator training and documentation so the SGR IT Manager can run the environment after handover.
2. Current Environment and Target State
Figures below are estimates. The selected provider must measure and confirm them during discovery.
| Area | Current | Target |
|---|---|---|
| Users | Approximately 19 | Approximately 19 on Microsoft 365 Business Premium (nonprofit) |
| Identity | Google Workspace accounts | Microsoft Entra ID |
| Mail and calendar | Gmail, Google Calendar | Exchange Online with Outlook |
| Files | Google Drive | OneDrive and SharePoint Online |
| Meetings and chat | Google Meet | Microsoft Teams |
| Devices | Approximately 20 Apple MacBooks from multiple vendors, not centrally managed | Same devices enrolled and managed in Intune |
| Endpoint protection | Not centrally managed | Microsoft Defender for Business |
| Device procurement | Mixed vendors, no central enrolment | Apple Business Manager linked to Intune |
| On-premises infrastructure | None | None, and none planned |
| Data to migrate | Approximately 1.2 TB (Gmail and Google Drive combined) | Migrated and validated in Microsoft 365 |
3. Scope of Work
The selected provider shall deliver the following services. Bidders may propose their own phasing, but every item below must be covered.
3.1 Assessment and discovery
- Audit the Google Workspace tenant: users, groups, aliases, delegated access, service accounts, shared drives, sharing permissions and external links, calendar resources and shared calendars.
- Measure actual mail and Drive volumes per user and per shared drive, rather than relying on the 1.2 TB estimate.
- Identify all third-party services that use "Sign in with Google" or integrate with Google Workspace, and propose how each will authenticate after migration.
- Inventory every MacBook: model, chipset, macOS version, purchase source, serial number and Apple Business Manager eligibility.
- Review domains, DNS hosting and current MX, SPF, DKIM and DMARC records.
- Produce a migration plan and risk assessment, including migration tooling, data mapping, pre-stage and delta sync approach, cutover runbook, rollback plan with go/no-go criteria, and an end-user communication plan.
3.2 Microsoft 365 tenant configuration
- Configure Entra ID: domains, users, groups, roles and group-based licensing.
- Enforce multi-factor authentication (Microsoft Authenticator) for all users and configure self-service password reset.
- Create and document break-glass emergency access accounts and apply a least-privilege administrator model.
- Build Conditional Access policies (MFA, block legacy authentication, compliant-device requirement), tested in report-only mode before enforcement.
- Apply Microsoft-recommended security baselines and Exchange Online protection (anti-spam, anti-phishing, Safe Links, malware).
- Configure baseline Microsoft Purview controls: starting sensitivity labels, data loss prevention rules and retention policies.
3.3 Google Workspace migration
- Migrate Gmail to Exchange Online, Google Calendar to Outlook, and Google Drive and shared drives to OneDrive and SharePoint Online.
- Agree how Google-native files (Docs, Sheets, Slides, Forms, Sites, Apps Script) will be converted or handled as exceptions.
- Run a pilot with the IT Manager and a small user group before production migration.
- Pre-stage bulk data ahead of cutover so the go-live weekend carries only the final delta sync, DNS change and validation.
- Execute the cutover over a single weekend and validate mail flow, calendar integrity, file access, permissions and sign-in against the agreed test plan.
- Provide on-site support on the first business day after cutover.
3.4 Microsoft Teams deployment
- Configure team and channel structure, meeting, messaging and calling policies, external and guest access, and collaboration settings.
3.5 Microsoft Intune implementation
- Configure macOS enrolment (Company Portal and Automated Device Enrolment where eligible).
- Deploy compliance policies (OS version, FileVault, firewall, password) and configuration profiles.
- Enable FileVault encryption with recovery key escrow and a software update policy.
- Deploy Microsoft 365 apps and agreed business applications.
- Enrol and validate all approximately 20 MacBooks, securing business data before any device reset.
3.6 Microsoft Defender for Business
- Onboard all enrolled devices through Intune and configure next-generation protection, attack surface reduction, alerting and reporting.
- Connect device risk signals to Conditional Access.
3.7 Apple Business Manager assessment and setup
- Create or verify the ABM account, complete Apple organization verification, and link ABM to Intune and Entra ID.
- Configure Automated Device Enrolment profiles and the Apps and Books token.
- Document per-device eligibility and recommend a future procurement path so new MacBooks enrol automatically.
3.8 Knowledge transfer and documentation
- Involve the SGR IT Manager throughout configuration.
- Deliver hands-on administrator training covering the admin center, Entra ID, Exchange Online, Intune, ABM and Defender.
- Deliver a short end-user readiness session with a written guide before cutover.
- Produce as-built documentation, an administrator runbook (including joiner and leaver procedures), support procedures and a handover report.
3.9 Post-go-live support
- Provide 30 days of included support from handover, covering defects, migration follow-up, enrolment issues and IT Manager assistance.
- Propose optional support arrangements beyond the 30 days, priced separately.
4. Deliverables
Each deliverable will be accepted by SGR against the criteria below. Migration acceptance is a separate, explicit sign-off after post-cutover validation.
| # | Deliverable | Acceptance criteria |
|---|---|---|
| D1 | Discovery and assessment report | Complete inventory of users, groups, shared drives, third-party integrations and devices, with measured data volumes and rated risks |
| D2 | Migration plan and implementation schedule | Approved by SGR; includes data mapping, cutover runbook, test plan, rollback triggers and communication plan |
| D3 | Configured Microsoft 365 tenant | Entra ID licensed; all users registered for MFA; SSPR live; break-glass accounts documented; Conditional Access enforced with no unintended lockouts |
| D4 | Exchange Online implementation | Mail flow tested inbound and outbound; SPF, DKIM and DMARC configured; protection policies applied |
| D5 | Teams implementation | Teams, channels and policies deployed; meetings, chat and external access tested |
| D6 | Intune implementation | Enrolment, compliance and configuration profiles deployed and validated on pilot devices |
| D7 | macOS device enrolment and management | All in-scope MacBooks enrolled, FileVault enabled with keys escrowed, every device compliant |
| D8 | Microsoft Defender for Business implementation | All enrolled devices onboarded and reporting; alerting configured; no unresolved high-severity alerts at handover |
| D9 | Apple Business Manager setup and recommendations | ABM created and linked to Intune; enrolment profile configured; per-device eligibility and procurement recommendations documented |
| D10 | Google Workspace data migration | Mail, calendar and Drive content migrated and validated; exceptions logged and accepted by SGR |
| D11 | IT Manager training | Training delivered and signed off by the SGR IT Manager; sessions recorded on request |
| D12 | As-built documentation and support procedures | Configuration documents, administrator runbook and end-user guide reviewed and accepted by SGR |
| D13 | Project handover report | Handover session completed; open items listed with owners and dates |
| D14 | 30 days post-go-live support | Support delivered from handover date, closed with a review of Secure Score, device compliance and open items |
5. Timeline and Migration Approach
The assignment should be completed within a maximum of six (6) weeks from contract signing, followed by 30 days of post-go-live support. Bidders must submit a detailed work plan; the phasing below is indicative.
| Phase | Key activities | Indicative duration |
|---|---|---|
| 1. Discovery and migration design | Google Workspace audit, device inventory, migration and rollback plan, SGR sign-off | Week 1 |
| 2. Tenant build and security baseline | Entra ID, MFA, Conditional Access (report-only), Exchange, Teams, SharePoint, Intune, Defender, ABM, Purview | Weeks 2 to 3 |
| 3. Pilot, data migration and cutover | Pilot group, bulk data pre-stage, device enrolment, cutover weekend, day-one support | Weeks 4 |
| 4. Stabilization and handover | Monitoring and tuning, residual items, training, documentation, handover | Weeks 5 to 6 |
The approach must respect these principles:
- Build alongside, then switch. The Microsoft 365 tenant is configured and tested while staff keep working in Google Workspace.
- Single-weekend cutover. The production cutover happens over one weekend, on a date approved by SGR that avoids month-end, audits and major events.
- Phase gates. No phase starts until SGR signs off the previous one; no user data moves before the tenant is accepted.
- Defined rollback. A written rollback plan with go/no-go criteria is agreed and tested before go-live.
- Google Workspace retained. Google Workspace stays licensed and available until SGR formally accepts the migration.
6. SGR Responsibilities
SGR will provide:
- Google Workspace and Microsoft 365 administrator access for the duration of the project.
- Access to DNS hosting, or a person able to make DNS changes during the cutover window.
- Confirmation that Microsoft 365 Business Premium nonprofit licences are active and sufficient.
- SGR's D-U-N-S number and an authorized contact for Apple Business Manager verification.
- Two to three pilot users, and access to all MacBooks for scheduled enrolment.
- Timely decisions and sign-offs within the turnaround agreed at kick-off.
7. Out of Scope
- On-premises infrastructure deployment, configuration or management.
- Windows device management (the estate is macOS only).
- Custom application development, including rebuilding Google Apps Script automations.
8. Key Personnel
The bidder must propose a team with, at minimum:
| Role | Minimum qualification | Minimum experience |
|---|---|---|
| Lead consultant / project lead | Degree in IT, computer science or related field; Microsoft 365 Administrator Expert or equivalent | 7 years, including at least 2 Microsoft 365 migrations as lead |
| Endpoint engineer | Microsoft Certified: Endpoint Administrator Associate or equivalent; Apple/macOS management experience | 3 years in system administration and device management |
| Security engineer | Relevant Microsoft security or identity certification (e.g. SC-300, SC-200) | 3 years in system administration or security operations |
9. Technical Proposal Requirements
- Company profile, registration documents and Microsoft Partner evidence
- Understanding of the assignment and proposed methodology
- Detailed work plan and timeline, including the proposed cutover weekend approach
- Proposed migration tooling and how it handles the 1.2 TB volume, Google API throttling and Google-native file conversion
- Rollback plan with go/no-go criteria
- Proposed security baseline, mapped to Microsoft recommendations or the CIS Critical Security Controls, stating any controls not covered
- Approach to enrolling existing MacBooks not eligible for Automated Device Enrolment
- Training and knowledge transfer plan
- Risk register with mitigations
- Assumptions and SGR responsibilities
- Post-implementation support options beyond the included 30 days
- Team composition, CVs and certifications
10. Financial Proposal Requirements
The financial proposal must be submitted in RWF and must show:
| Section | Content required |
|---|---|
| A. Migration and implementation services | Itemized by phase or service area, at standard commercial rates |
| B. 30-day post-go-live support | Confirmed as included, or priced if not |
| C. Optional items | Each optional item (Section 7) priced separately |
The bidder must also state the quotation validity period and proposed payment terms.
11. Evaluation Criteria
| Criterion | Weight |
|---|---|
| Methodology, work plan, cutover and rollback approach | 25% |
| Experience with similar Microsoft 365 migrations and macOS management (references) | 20% |
| Qualifications and certifications of key personnel | 15% |
| Security baseline, training and knowledge transfer plan | 10% |
| Pricing competitiveness and transparency | 25% |
| Experience with NGOs or the development sector | 5% |
IV. Standard Provisions
Guidelines, policies and ethics. All bidders must commit to the SGR Procurement Procedures Manual, the SGR Anti-terrorism and Anti-money Laundering Policy, and the SGR Anti-fraud, Bribery and Corruption Policy.
Conflict of interest and disqualification. Bidders shall disclose any relationship with SGR staff and shall not submit more than one bid. SGR will disqualify any bidder that attempts to influence the process improperly, colludes with other bidders, engages in bribery, is blacklisted by the Rwanda Public Procurement Authority or SGR, has corruption-related convictions, unresolved contract disputes or is in bankruptcy proceedings. Bids received late, incomplete, with unsigned handwritten amendments, or with misleading information will also be disqualified.
Data protection and confidentiality. The selected provider will have administrative access to SGR systems and data. It must sign a confidentiality and data processing agreement, comply with Rwanda's Law No. 058/2021 on the protection of personal data and privacy, use access only for this assignment, and return or remove all credentials and data at handover.
Evaluation and award. The contract will be awarded through quality and cost-based selection to the responsive bidder with the highest combined score. SGR may request clarifications, a presentation of the proposed approach, or negotiate with any bidder before award.
Withdrawal. SGR reserves the right to withdraw this tender at any time without notice or liability, and to accept or reject any bid without giving reasons.
Tender costs. Bidders bear all costs of preparing their bid, whether or not successful.
Notification of award. All bidders will receive formal notification of the outcome.
Bid validity. Bids shall remain valid for 60 days from the submission deadline.
V. Guideline for Bid Submission
Interested and qualified firms must submit separate technical and financial proposals electronically to recruitment@sustainablegrowers.org not later than 23 October 2026 at 5:00 PM (17h00) local time. Late bids will be automatically rejected.
Questions may be sent to the same address no later than 21 October 2026 at 5:00 PM (17h00) local time. Only written answers issued by SGR are official; verbal information from SGR staff is not binding. SGR may request further information from any bidder, and failure to respond by the stated deadline may lead to disqualification.
Done at Kigali, on 13 October 2026
Christine Condo
Chief Executive Officer, Sustainable Growers