EnterraHost
Moving off Google Workspace is mostly an administrative job before it is a technical one. Two things have to be true before any mail can be copied, and both are usually off by default. IMAP access has to be enabled, and there has to be a way to sign in that is not the account's normal password.
Why the normal password will not work
Google stopped accepting plain username-and-password sign-in from third-party tools some years ago, and pushes everything toward a browser-based sign-in instead. A migration reads your mail over IMAP rather than through a browser, so the account's own password is refused.
The replacement is an app password, which is a separate password for one purpose. Two things gate it. Two-step verification has to be switched on for the account first, and the organization's policy has to allow app passwords at all. If your Workspace is managed by somebody else, that second condition is theirs to decide rather than yours, and it is worth checking before you plan a date.
If you manage the Workspace domain
There is an organization-level switch to turn on. In the admin console, IMAP access sits under the Gmail end-user settings, and it can be enabled for everyone or scoped to an organizational unit. If you use organizational units, check which one you have selected before saving, because turning IMAP on for the wrong group is a change that affects people who did not ask for it.
Then, per mailbox
Three things, and they are per account rather than per domain. Turn IMAP on in the Gmail settings under the forwarding and POP/IMAP tab. Turn on two-step verification. Then generate the app password and label it for the migration so it is not confused with anything else later.
Copy the app password somewhere secure when it is shown, because Google will not display it again.
One trap worth knowing in advance. Changing the account's main Google password revokes the app passwords already issued, and a migration that is halfway through will fail at that point. If you are migrating several mailboxes, ask people not to change their Google password until the copy is finished.
Which tier matches what you actually use
Gmail itself maps to any mailbox here, because mail is mail. What differs between Lite and Pro is everything around it.
If your team lives in Gmail, uses chat and video calls in the browser, and shares files casually, Lite covers that ground. If calendars and contacts need to follow people onto phones and into desktop clients, if you want shared calendars, or if real-time document editing is part of how you work, Pro is the closer match. The full comparison is on the business email page.
You do not have to decide for the whole domain at once. Lite and Pro mailboxes mix under one domain, so a team can land on different tiers by what each person does.
Getting the mail across
Once IMAP is on and you have an app password per mailbox, the copy itself is the same job as any other provider. Moving your existing mail across covers the order to do things in, and why the DNS change comes last rather than first.
We can run the copy for you if you would rather not, but doing it yourself is straightforward and there is nothing to install. Either way the sequence is the same, and the only part with a deadline is the DNS switch.