The user does not have to be disconnected from their mailbox during this migration process.
mboxutil -r should lock everything that needs to be locked. Delivery may be stalled while that happens, and POP and IMAP and therefore webmail clients, may experience a delay, but there should be no problem.
Move the user mailbox with the following command:
mboxutil -r user/<userid>/INBOX user/<userid>/INBOX <partition_name>
mboxutil -r user/ofanning/INBOX user/ofanning/INBOX secondary
Set the mailMessageStore attribute in the moved user’s LDAP entry to the name of the new partition.
Example: mailMessageStore: secondary
Inform the user that message store connection is now allowed. If applicable, change the mailAllowedServiceAccess attribute to allow POP, IMAP and HTTP services.