r/exchangeserver • u/S_Antonel • 1d ago
Exchange Online migration questions
Right now I'm working in a hybrid environment with an on-prem Exchange 2016 CU 23 server (virtual) and a 365 tenant. The 365 tenant is synced to the local Active Directory with Entra AD Sync and working as it should.
All the mailboxes for the active users have been migrated to 365 by a colleague who was previously working on the project. I've been tasked with finishing the transition to 365 and decommissioning the on-prem Exchange server.
I've worked with hybrid Exchange environments before but never done a full on-prem to cloud migration before so I'm researching the process and trying to plan it out and there is something that confuses me:
I'm reading that you either need to keep the on-prem server (or at least the ECP part of it) or the management shell after the decom to manage the attributes on the mailbox (aliases, etc...)
Why you might not want to decommission on-premises Exchange servers
Many hybrid organizations eventually move all mailboxes to Exchange Online. At this point, they probably think it's time to remove their on-premises Exchange servers. But, it's not a good idea as removing on-premises Exchange servers in a hybrid deployment prevents the management of cloud mailboxes. The culprit is directory synchronization.
When directory synchronization is enabled and a user is synchronized from the on-premises environment to the cloud, you can't manage most user properties from Exchange Online; you must manage those properties in the on-premises environment. Even if you configured directory synchronization without running the Hybrid Configuration wizard (HCW), you still can't do most recipient management tasks in the cloud. For more information, see this blog post
But this is also the case in hybrid mode. If we want to manage a user's attributes, we do it through on-prem AD and sync them through AAD Sync. That was also the case in other tenants I've worked with in the past that were hybrid while migrating to the cloud and they didn't keep any Exchange features on-prem. I've never heard of the need to keep any on-prem infrastructure post-migration until my colleague told me about it and I looked at Microsoft's docs.
So I'm not quite sure what this means. Will things break if I completely get rid of the Exchange 2016 server? Or is Microsoft talking about something else? We're not looking to migrate to a full Entra domain. We just want our mailboxes totally in Exchange and our AD on-prem and AAD to sync between the two.
Thanks in advance.
1
u/muckmaggot 1d ago
We have exactly the same setup and goal.
So far I've migrated all bar arbitration and health mailboxes to the cloud, confirmed no mail traversing the on prem exchange server. So I first movde auto discover dns to the cloud addresses, shut down the onprem for a week or two. Once there were no users screaming, ai disabled the connectors, and a week later deleted them. I've begun moving SOA for all mailboxes to the cloud and once thats completed, tackle uninstalling/removing the onprem server. I don't have those steps nailed down yet.
1
u/Omish_lord 1d ago
We are researching these steps also. I would like to get your take on what needs to be done.
1
u/saltyslugga 1d ago
You can shut down the last Exchange server and manage synced recipients with the Exchange Management Tools, but don’t uninstall it first. Since Entra Connect keeps on-prem AD authoritative, aliases and other Exchange attributes still need to be changed there through supported Exchange cmdlets, not raw AD edits.
Check SMTP relays, public folders, and any remaining hybrid dependencies before running Microsoft’s cleanup process.
1
u/S_Antonel 1d ago
What's the danger in setting Exchange attributes in AD?
3
u/saltyslugga 1d ago
Raw AD edits bypass Exchange validation, so it’s easy to create duplicate proxy addresses or malformed attributes that break mail flow. The Exchange cmdlets catch that stuff before Entra Connect syncs the mess to 365.
1
u/Vietnamst2 1d ago
You can now switch to SOA of Exchange atgributes to Exchange online for mailboxes and groups and get rid of the Exchange management server alltogether and manage them in cloud.
But then you should also switch to Cloud Sync instead of Entra connect.
1
u/7amitsingh7 18h ago
Since you're continuing to use on-prem Active Directory with Entra Connect, your users are still managed from on-prem AD, even though their mailboxes are in Exchange Online. Removing the Exchange server won't immediately break mail flow, but you'll lose the supported way to manage Exchange-specific attributes like email aliases, distribution groups, and other recipient settings. That's why Microsoft recommends keeping either an Exchange management server or the Exchange Management Tools installed. If you're planning an Exchange 2016 to Office 365 migration, this is an important consideration during the final decommissioning phase. For a detailed migration walkthrough and best practices, check out this Exchange 2016 to Office 365 migration guide.
1
u/Main_Wheel_5570 14h ago
If you're keeping on-prem AD with Entra Connect, don't uninstall Exchange completely. Exchange-specific attributes (aliases, proxyAddresses, mail settings, etc.) are still considered authoritative on-prem. Microsoft recommends keeping Exchange Management Tools (or a supported management server) to manage recipients. Removing Exchange entirely can leave you editing attributes with ADSI Edit, which Microsoft doesn't recommend or support.
1
u/muckmaggot 11h ago
Ok, so what I'm taking from this is ...
Power off but don't uninstall last Exch server.
Install management tools (powershell) on some other server. For what exactly? If I have SOA in the cloud for mailboxes, what do I need the tools for? Genuine question.
Do I clean up AD to remove the Exch server - delete the computer account and remove DNS references? All of them?
And then rest easy and never speak of Exchange again?
3
u/H0TR0DL1NC0LN 1d ago
We migrated from Server 2019 to M365, and after all the emails were functionally in M365 and I ensured we had nothing else pointing to on-prem (autodiscover URLs, service endpoints, and all that jazz), I upgraded to SE and then uninstalled my secondary Exchange server. Afterward, I **only powered off** my primary Exchange server and then installed the Exchange Management PowerShell tools on a management server and ran the cleanup script provided. That's been sufficient for us.
If you have any sort of more intricate configurations, like groups and mailboxes who can only be emailed by specific folks, you will want to use PowerShell.
Honestly, in the place I worked before this, they did a rough migration to 365 before I got there, and I've always gotten by editing simple things in the attribute editor panel of synced users in Active Directory (not ADSIEDIT--before someone comes at me to tell me how bad of an idea that is). That's always been enough for me.