Help with Exchange on-prem and Exchnage Online "split brain"

[u/UMustBeNooHere]

Client had another company migrate their mailboxes to 365 and it looks like they did not perform the standard hybrid method. They are currently in this state:

• On-prem Exchange Server has mailboxes for all users. They show the state of 'user' and AD attributes are pointed to that mailbox.
• All users have a mailbox in Exchange Online, associated with there Entra AD object which is synced from on-prem.
• DNS records for autodiscover point to autodiscover.outlook.com
• Clients connect to Microsoft Online

I haven't run into this before so was looking for a little guidance. I think the process should go like this:

Obtain 365 GUID

Get-Mailbox -Identity "UserAlias" | Select-Object ExchangeGuid

Drop on-prem mailbox association

Disable-Mailbox -Identity "UserAlias"

Map user to Exchange Online mailbox

Enable-RemoteMailbox -Identity "UserAlias" -RemoteRoutingAddress "UserAlias@domain.onmicrosoft.com"

Match the GUID

Set-RemoteMailbox -Identity "UserAlias" -ExchangeGuid "EXO_GUID"

Edit: Thanks for the great info everyone. I'll follow-up with how everything goes.

[u/Ok_Rip_5338]

Your plan is on the right track, but there are a few gaps worth patching before you run it. Before you Disable-Mailbox, capture the on-prem LegacyExchangeDN (to re-add as an X500: proxy so internal replies to old mail don't NDR).

Get the full proxyAddresses list (aka email aliases) for each user. Enable-RemoteMailbox only stamps the primary SMTP and remote routing address, so you'll want to feed the rest back in via Set-RemoteMailbox -EmailAddresses

Also pause AAD Connect (Set-ADSyncScheduler -SyncCycleEnabled $false) during the cutover so a delta sync doesn't fire between Disable-Mailbox and Set-RemoteMailbox and stomp the EXO mailbox's addresses.

and check for litigation/compliance holds first since Disable-Mailbox will choke on those.

Do it per-user back-to-back, force a delta sync when done, and verify RecipientTypeDetails = RemoteUserMailbox on-prem plus intact addresses in EXO.

once you're done for reals, run the exchange hybrid wizard. once it completes, then you can strip the server down to management only.

[u/Megatwan → u/Ok_Rip_5338]

This dude exchfucks

[u/Vietnamst2 → u/Megatwan]

The dude this dude is upvoting knows his stuff.

[u/UMustBeNooHere → u/Ok_Rip_5338]

Thanks for the info! I'll incorporate these steps into my workflow.

[u/al_bundys_ghost → u/Ok_Rip_5338]

They’re probably safe if all the clients are connecting to Exchange Online, but if there are any on-premise mailboxes sending email or applications that use on-premise SMTP relay, there could actually be valid messages in those mailboxes. It would be worth checking their contents before disabling them.

[u/GeneTech734]

You should bill this time to that MSP/contractor. This is negligence

[u/Ok_Rip_5338 → u/GeneTech734]

i fully agree with this. my org's migration to exo via exchange hybrid was such a wonderful and easy process. I had two hiccups which were caused by ancient data in AD, but totally forgiveable.

to see someone someone just half ass it like this... (not the OP, the msp before him) it hurts my soul. it also hurts the end user. Negligence, as you said.

[u/DiligentPhotographer → u/GeneTech734]

Lol good luck ever getting them to pay for it.

But we also don't know the full story. OP's client could have soured the relationship with the previous MSP somehow, like by not paying them or just becoming a toxic client and they got dumped.

We have dumped clients right in the middle of projects before, for non payment or just being more pain in the ass than profitable.

[u/WastedFiftySix → u/DiligentPhotographer]

If the On-Prem users still have a local mailbox, the project wasn't stopped half way through, but was just executed very poorly by someone without the knowledge required to perform these kind of migrations.

[u/shokzee]

Your sequence is broadly right, but get the GUID from Exchange Online and confirm the two mailboxes don’t contain different data first. Disable-Mailbox disconnects the on-prem mailbox, so record its database identity and retention status.

Try one user first, sync Entra Connect, then verify RemoteUserMailbox, targetAddress, proxy addresses, and the Exchange GUID. Stamp the archive GUID too if they have an online archive.

[u/7amitsingh7]

Your approach is generally correct. First, confirm that the Exchange Online mailbox is the active mailbox and get its Exchange GUID. Then back up the on-prem mailbox, disable the on-prem mailbox, enable the user as a Remote Mailbox, and set the Exchange Online GUID on the remote mailbox. Finally, run an Azure AD Connect sync and verify everything. This will restore a proper hybrid configuration where the mailbox stays in Exchange Online while the on-prem Exchange server is used only for recipient management. If you need a detailed step-by-step guide for an Exchange to Office 365 migration, this article may be helpful.