Phase 2, compliant migration. Provisioned a new US-resident tenant, set up and assigned licenses, and migrated all five mailboxes by PST, the right-sized method for a mailbox-only environment with no SharePoint or Teams. Repointed MX, SPF, DKIM, and DMARC, reconnected every user, and decommissioned the old tenant.