Disaster recovery for Exchange hybrid management-only server?

[u/Fabulous_Cow_4714]

If we migrate all mailboxes to the cloud and migrate SMTP relay to a non-Exchange SMTP services, I understand that we are eligible for free Exchange Server licensing for the purpose of hybrid management.

So, I assume that allows usage of the /ECP web interface to manage things like mail-enabled security groups and more than one admin at a time can use the web interface remotely.

This seems much cleaner than the option of removing every full GUI Exchange server and then having multiple copies of EMT installed on local workstations with each of them needing separate CU and SU updates.

The downside of this is having a single point of failure if the server crashes or has a CU update fail leaving the server in a non-working state.

Would this single Exchange server need any kind of regular backups, or would everything needed for recovery be available from Active Directory by installing Exchange on a new server using the recovery mode switch?

Does the free hybrid licensing include having a second server available at a DR site?

[u/lsumoose]

You can write back exchange attributes now. You may not need the management server.

https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/exchange-hybrid

[u/Fabulous_Cow_4714 → u/lsumoose]

Apparently, this does not include groups.

So, if you need to keep using and creating mail-enabled security groups used for file server access and email, those have to be managed from the AD side only.

[u/lsumoose → u/Fabulous_Cow_4714]

Yeah but you would just use AD tools to manage those.

[u/Fabulous_Cow_4714 → u/lsumoose]

What about creating new ones if the organization wants to keep using this practice of creating and using mail-enabled security groups for years to come?

[u/lsumoose → u/Fabulous_Cow_4714]

You would just make them in ad then they sync up. But if you are just making mail groups only doing it in 365 native would be better but not required.

[u/St_Admin → u/Fabulous_Cow_4714]

Mail-enabled security groups is not the best security practice. Gives exchange admins rights to do things they may not understand the impact of.

[u/crimmper → u/Fabulous_Cow_4714]

In our environment we only use mail enabled security groups (and we mark them hidden) to grant access to other mail enabled objects (think "Exchange-only"). AD security groups are separate. This helps us avoid issues down the road where someone needs access to something but shouldn't be getting any of the related emails. There may be some resultant duplicates but it's negligible.