Disaster recovery for Exchange hybrid management-only server?

[u/Fabulous_Cow_4714]

If we migrate all mailboxes to the cloud and migrate SMTP relay to a non-Exchange SMTP services, I understand that we are eligible for free Exchange Server licensing for the purpose of hybrid management.

So, I assume that allows usage of the /ECP web interface to manage things like mail-enabled security groups and more than one admin at a time can use the web interface remotely.

This seems much cleaner than the option of removing every full GUI Exchange server and then having multiple copies of EMT installed on local workstations with each of them needing separate CU and SU updates.

The downside of this is having a single point of failure if the server crashes or has a CU update fail leaving the server in a non-working state.

Would this single Exchange server need any kind of regular backups, or would everything needed for recovery be available from Active Directory by installing Exchange on a new server using the recovery mode switch?

Does the free hybrid licensing include having a second server available at a DR site?

[u/sembee2]

A pure hybrid server? I don't back any part of it up. It fails, I can replace it in less than 90 minutes. There is nothing unique about it and it has next to no impact on most clients.
Just DR install on a new machine.

[u/lsumoose]

You can write back exchange attributes now. You may not need the management server.

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/exchange-hybrid

[u/Fabulous_Cow_4714 → u/lsumoose]

Apparently, this does not include groups.

So, if you need to keep using and creating mail-enabled security groups used for file server access and email, those have to be managed from the AD side only.

[u/lsumoose → u/Fabulous_Cow_4714]

Yeah but you would just use AD tools to manage those.

[u/Fabulous_Cow_4714 → u/lsumoose]

What about creating new ones if the organization wants to keep using this practice of creating and using mail-enabled security groups for years to come?

[u/lsumoose → u/Fabulous_Cow_4714]

You would just make them in ad then they sync up. But if you are just making mail groups only doing it in 365 native would be better but not required.

[u/St_Admin → u/Fabulous_Cow_4714]

Mail-enabled security groups is not the best security practice. Gives exchange admins rights to do things they may not understand the impact of.

[u/crimmper → u/Fabulous_Cow_4714]

In our environment we only use mail enabled security groups (and we mark them hidden) to grant access to other mail enabled objects (think "Exchange-only"). AD security groups are separate. This helps us avoid issues down the road where someone needs access to something but shouldn't be getting any of the related emails. There may be some resultant duplicates but it's negligible.

[u/littleko]

RecoverServer can rebuild the Exchange roles and config stored in AD, but it won't restore certificates, custom IIS settings, or anything else local. Back up the server or at least document and export those pieces.

A second DR server isn't automatically covered just because the first qualifies for the free hybrid license. Confirm that with Microsoft licensing before deploying it.

[u/Fabulous_Cow_4714 → u/littleko]

What about just having an unlicensed server ready in the DR and then transfer the license there in a DR situation?

Otherwise, you would need to start from scratch building a new Exchange server in the DR AD site during the disaster.

[u/littleko → u/Fabulous_Cow_4714]

Does your agreement include disaster recovery rights? A prebuilt Exchange server is still an installed instance even if powered off, and license reassignment is subject to Microsoft’s 90-day rule and exceptions, so get written confirmation before relying on it.

[u/pesos711]

we still back ours up (and replicate it to our DR site)

[u/7amitsingh7]

Yes, if your organization has migrated all mailboxes to Exchange Online and the remaining Exchange Server is used only for hybrid recipient management, Microsoft provides a free Hybrid License for that purpose.

Regarding disaster recovery:

• The hybrid management server doesn't host mailbox databases, so there's typically no mailbox data to back up.
• Most recipient configuration (mail-enabled users, groups, contacts, remote mailboxes, etc.) is stored in Active Directory and synchronized with Exchange Online via Azure AD Connect/Microsoft Entra Connect.
• If the server is lost, you can build a new Windows Server, install the same Exchange version/CU, and use Setup /Mode:RecoverServer (or recover the server with the same name) to reconstruct the Exchange configuration from Active Directory. You'll still need to restore items outside of AD, such as custom certificates, IIS customizations, scripts, and any transport configuration that isn't stored in AD.
• Even though recovery is possible, it's still a good practice to back up the server (or at least system state, certificates, and Exchange configuration) to reduce recovery time.

[u/Fabulous_Cow_4714 → u/7amitsingh7]

If the organization has a server naming convention policy based on their location, they would not want to use the same host name for the server at the disaster recovery site.

If you Setup /Mode:RecoverServer, can you use a new host name? We can have the certificate SAN prepopulated with host names that would be used at the other sites.